drivers/iio/industrialio-buffer.c:1919 iio_buffer_enqueue_dmabuf() warn: passing freed memory '&fence->base' (line 1912)
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] CC: [email protected] TO: "Benoît Monin" <[email protected]> CC: Jonathan Cameron <[email protected]> CC: Paul Cercueil <[email protected]> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: cb8a75eec0877810b50aa1c5a833f929525cd2ee commit: a093999355084bdbfe6e97f1dd232e58a1525f0b iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() date: 3 months ago :::::: branch date: 6 hours ago :::::: commit date: 3 months ago config: arc-randconfig-r071-20260820 (https://download.01.org/0day-ci/archive/20260820/[email protected]/config) compiler: arc-linux-gcc (GCC) 8.5.0 smatch: v0.5.0-9187-g5189e3fb If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Fixes: a09399935508 ("iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()") | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ smatch warnings: drivers/iio/industrialio-buffer.c:1919 iio_buffer_enqueue_dmabuf() warn: passing freed memory '&fence->base' (line 1912) vim +1919 drivers/iio/industrialio-buffer.c 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1821 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1822 static int iio_buffer_enqueue_dmabuf(struct iio_dev_buffer_pair *ib, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1823 struct iio_dmabuf __user *iio_dmabuf_req, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1824 bool nonblock) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1825 { 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1826 struct iio_buffer *buffer = ib->buffer; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1827 struct iio_dmabuf iio_dmabuf; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1828 struct dma_buf_attachment *attach; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1829 struct iio_dmabuf_priv *priv; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1830 struct iio_dma_fence *fence; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1831 struct dma_buf *dmabuf; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1832 unsigned long timeout; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1833 bool cookie, cyclic, dma_to_ram; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1834 long retl; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1835 u32 seqno; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1836 int ret; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1837 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1838 if (copy_from_user(&iio_dmabuf, iio_dmabuf_req, sizeof(iio_dmabuf))) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1839 return -EFAULT; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1840 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1841 if (iio_dmabuf.flags & ~IIO_BUFFER_DMABUF_SUPPORTED_FLAGS) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1842 return -EINVAL; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1843 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1844 cyclic = iio_dmabuf.flags & IIO_BUFFER_DMABUF_CYCLIC; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1845 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1846 /* Cyclic flag is only supported on output buffers */ 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1847 if (cyclic && buffer->direction != IIO_BUFFER_DIRECTION_OUT) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1848 return -EINVAL; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1849 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1850 dmabuf = dma_buf_get(iio_dmabuf.fd); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1851 if (IS_ERR(dmabuf)) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1852 return PTR_ERR(dmabuf); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1853 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1854 if (!iio_dmabuf.bytes_used || iio_dmabuf.bytes_used > dmabuf->size) { 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1855 ret = -EINVAL; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1856 goto err_dmabuf_put; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1857 } 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1858 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1859 attach = iio_buffer_find_attachment(ib, dmabuf, nonblock); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1860 if (IS_ERR(attach)) { 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1861 ret = PTR_ERR(attach); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1862 goto err_dmabuf_put; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1863 } 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1864 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1865 priv = attach->importer_priv; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1866 bf4afc53b77aea Linus Torvalds 2026-02-21 1867 fence = kmalloc_obj(*fence); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1868 if (!fence) { 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1869 ret = -ENOMEM; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1870 goto err_attachment_put; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1871 } 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1872 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1873 fence->priv = priv; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1874 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1875 seqno = atomic_add_return(1, &priv->seqno); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1876 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1877 /* 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1878 * The transfers are guaranteed to be processed in the order they are 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1879 * enqueued, so we can use a simple incrementing sequence number for 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1880 * the dma_fence. 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1881 */ 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1882 dma_fence_init(&fence->base, &iio_buffer_dma_fence_ops, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1883 &priv->lock, priv->context, seqno); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1884 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1885 ret = iio_dma_resv_lock(dmabuf, nonblock); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1886 if (ret) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1887 goto err_fence_put; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1888 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1889 timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1890 dma_to_ram = buffer->direction == IIO_BUFFER_DIRECTION_IN; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1891 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1892 /* Make sure we don't have writers */ 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1893 retl = dma_resv_wait_timeout(dmabuf->resv, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1894 dma_resv_usage_rw(dma_to_ram), 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1895 true, timeout); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1896 if (retl == 0) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1897 retl = -EBUSY; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1898 if (retl < 0) { 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1899 ret = (int)retl; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1900 goto err_resv_unlock; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1901 } 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1902 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1903 if (buffer->access->lock_queue) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1904 buffer->access->lock_queue(buffer); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1905 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1906 ret = dma_resv_reserve_fences(dmabuf->resv, 1); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1907 if (ret) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1908 goto err_queue_unlock; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1909 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1910 dma_resv_add_fence(dmabuf->resv, &fence->base, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1911 dma_to_ram ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ); a093999355084b Benoît Monin 2026-04-01 @1912 dma_fence_put(&fence->base); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1913 dma_resv_unlock(dmabuf->resv); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1914 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1915 cookie = dma_fence_begin_signalling(); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1916 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1917 ret = buffer->access->enqueue_dmabuf(buffer, priv->block, &fence->base, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1918 priv->sgt, iio_dmabuf.bytes_used, 3e26d9f08fbe0b Paul Cercueil 2024-06-20 @1919 cyclic); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1920 if (ret) { 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1921 /* 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1922 * DMABUF enqueue failed, but we already added the fence. 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1923 * Signal the error through the fence completion mechanism. 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1924 */ 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1925 iio_buffer_signal_dmabuf_done(&fence->base, ret); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1926 } 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1927 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1928 if (buffer->access->unlock_queue) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1929 buffer->access->unlock_queue(buffer); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1930 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1931 dma_fence_end_signalling(cookie); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1932 dma_buf_put(dmabuf); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1933 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1934 return ret; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1935 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1936 err_queue_unlock: 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1937 if (buffer->access->unlock_queue) 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1938 buffer->access->unlock_queue(buffer); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1939 err_resv_unlock: 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1940 dma_resv_unlock(dmabuf->resv); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1941 err_fence_put: 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1942 dma_fence_put(&fence->base); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1943 err_attachment_put: 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1944 iio_buffer_dmabuf_put(attach); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1945 err_dmabuf_put: 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1946 dma_buf_put(dmabuf); 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1947 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1948 return ret; 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1949 } 3e26d9f08fbe0b Paul Cercueil 2024-06-20 1950 :::::: The code at line 1919 was first introduced by commit :::::: 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f iio: core: Add new DMABUF interface infrastructure :::::: TO: Paul Cercueil <[email protected]> :::::: CC: Jonathan Cameron <[email protected]> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki