The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware ARM DMA backend. The current code creates a dma_iommu_mapping and attaches this to the ISP device, but never detaches the mapping in either the probe failure paths or the driver remove path resulting in an unbalanced mapping refcount and a memory leak. Fix this properly. Reported-by: Pavel Machek <pavel@xxxxxx> Signed-off-by: Suman Anna <s-anna@xxxxxx> Tested-by: Pavel Machek <pavel@xxxxxx> --- Hi Mauro, Laurent, This fixes an issue reported by Pavel and discussed on this thread, https://marc.info/?l=linux-omap&m=152051945803598&w=2 Posting this again to the appropriate lists. regards Suman drivers/media/platform/omap3isp/isp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c index 8eb000e3d8fd..c7d667bfc2af 100644 --- a/drivers/media/platform/omap3isp/isp.c +++ b/drivers/media/platform/omap3isp/isp.c @@ -1945,6 +1945,7 @@ static int isp_initialize_modules(struct isp_device *isp) static void isp_detach_iommu(struct isp_device *isp) { + arm_iommu_detach_device(isp->dev); arm_iommu_release_mapping(isp->mapping); isp->mapping = NULL; } @@ -1971,13 +1972,15 @@ static int isp_attach_iommu(struct isp_device *isp) ret = arm_iommu_attach_device(isp->dev, mapping); if (ret < 0) { dev_err(isp->dev, "failed to attach device to VA mapping\n"); - goto error; + goto error_attach; } return 0; +error_attach: + arm_iommu_release_mapping(isp->mapping); + isp->mapping = NULL; error: - isp_detach_iommu(isp); return ret; } -- 2.16.2
