Re: Nokia N900: refcount_t underflow, use after free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 03/10/2018 05:26 AM, Pavel Machek wrote:
> Hi!
> 
>>>>> Well, there certainly seems to be an obvious bug wherein
>>>>> isp_detach_iommu() just releases the mapping directly without calling
>>>>> arm_iommu_detach_device() to balance the equivalent attach. That can't
>>>>> be helping.
>>>>
>>>> Indeed, I have been able to reproduce the same warning using a
>>>> standalone test module, and the missing arm_iommu_detach_device() is
>>>> causing the warning after probe (during failure path) or during
>>>> remove.
>>>
>>> Ok do you have an idea how to fix the isp error paths? Untested patch
>>> would be fine... But it seems that you know what needs to be fixed and
>>> I don't.
>>>
>>
>> OK, see if the following fixes the issue for you, only build tested.
> 
> Word-wrapped, so I applied by hand. And yes, the oops at boot is
> gone. Thanks!

Sorry about that, have to check my mail settings. Anyway will post the
patch again, glad that it fixed your issue.

regards
Suman

> 
> (Camera still does not work in -next... kills system. Oh well. Lets
> debug that some other day.)
> 
>> 8< ---------------------
>> >From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001
>> From: Suman Anna <s-anna@xxxxxx>
>> Date: Fri, 9 Mar 2018 16:39:59 -0600
>> Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping
>>
>> The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware
>> ARM DMA backend. The current code creates a dma_iommu_mapping and
>> attaches this to the ISP device, but never detaches the mapping in
>> either the probe failure paths or the driver remove path resulting
>> in an unbalanced mapping refcount and a memory leak. Fix this properly.
>>
>> Reported-by: Pavel Machek <pavel@xxxxxx>
>> Signed-off-by: Suman Anna <s-anna@xxxxxx>
> 
> Tested-by: Pavel Machek <pavel@xxxxxx>
> 									Pavel
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Arm (vger)]     [ARM Kernel]     [ARM MSM]     [Linux Tegra]     [Linux WPAN Networking]     [Linux Wireless Networking]     [Maemo Users]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Trails]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux