diff mbox series

[5.10,14/86] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources

Message ID 20220426081741.617352615@linuxfoundation.org
State Superseded
Headers show
Series None | expand

Commit Message

Greg KH April 26, 2022, 8:20 a.m. UTC 
From: zhangqilong <zhangqilong3@huawei.com>

[ Upstream commit 545b2baac89b859180e51215468c05d85ea8465a ]

pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
We fix it:
1) Replacing it with pm_runtime_resume_and_get to keep usage counter
   balanced.
2) Add putting operation before returning error.

Fixes:9135408c3ace4 ("dmaengine: mediatek: Add MediaTek UART APDMA support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20220319022142.142709-1-zhangqilong3@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mediatek/mtk-uart-apdma.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

Comments

Pavel Machek April 27, 2022, 8:28 p.m. UTC | #1 
Hi!

> pm_runtime_get_sync will increment pm usage counter even it failed.
> Forgetting to putting operation will result in reference leak here.
> We fix it:
> 1) Replacing it with pm_runtime_resume_and_get to keep usage counter
>    balanced.

Suspect.

> 2) Add putting operation before returning error.

Yes but you also put in success case, which is likely
wrong. mtk_uart_apdma_free_chan_resources() does second put.

> +++ b/drivers/dma/mediatek/mtk-uart-apdma.c
> @@ -274,7 +274,7 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
>  	unsigned int status;
>  	int ret;
>  
> -	ret = pm_runtime_get_sync(mtkd->ddev.dev);
> +	ret = pm_runtime_resume_and_get(mtkd->ddev.dev);
>  	if (ret < 0) {
>  		pm_runtime_put_noidle(chan->device->dev);
>  		return ret;


This is suspect, too. What is the put_noidle doing there? Seems like
it was meant to undo the get_sync operation, but uses different
argument?

> @@ -288,18 +288,21 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
>  
>  	if (mtkd->support_33bits)
>  		mtk_uart_apdma_write(c, VFF_4G_SUPPORT, VFF_4G_SUPPORT_CLR_B);
>  
> +err_pm:
> +	pm_runtime_put_noidle(mtkd->ddev.dev);
>  	return ret;
>  }

This should only be done in error case.

Best regards,
								Pavel
Pavel Machek April 27, 2022, 8:32 p.m. UTC | #2 
Hi!

> > pm_runtime_get_sync will increment pm usage counter even it failed.
> > Forgetting to putting operation will result in reference leak here.
> > We fix it:
> > 1) Replacing it with pm_runtime_resume_and_get to keep usage counter
> >    balanced.
> 
> Suspect.
> 
> > 2) Add putting operation before returning error.
> 
> Yes but you also put in success case, which is likely
> wrong. mtk_uart_apdma_free_chan_resources() does second put.

This is possible fix for the second problem:

Signed-off-by: Pavel Machek <pavel@denx.de>

diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
index a1517ef1f4a0..8ec046a7e714 100644
--- a/drivers/dma/mediatek/mtk-uart-apdma.c
+++ b/drivers/dma/mediatek/mtk-uart-apdma.c
@@ -300,7 +300,8 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
 
 	if (mtkd->support_33bits)
 		mtk_uart_apdma_write(c, VFF_4G_SUPPORT, VFF_4G_SUPPORT_CLR_B);
-
+	return 0;
+	
 err_pm:
 	pm_runtime_put_noidle(mtkd->ddev.dev);
 	return ret;

Best regards,
								Pavel
diff mbox series

Patch

diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
index 375e7e647df6..a1517ef1f4a0 100644
--- a/drivers/dma/mediatek/mtk-uart-apdma.c
+++ b/drivers/dma/mediatek/mtk-uart-apdma.c
@@ -274,7 +274,7 @@  static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
 	unsigned int status;
 	int ret;
 
-	ret = pm_runtime_get_sync(mtkd->ddev.dev);
+	ret = pm_runtime_resume_and_get(mtkd->ddev.dev);
 	if (ret < 0) {
 		pm_runtime_put_noidle(chan->device->dev);
 		return ret;
@@ -288,18 +288,21 @@  static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
 	ret = readx_poll_timeout(readl, c->base + VFF_EN,
 			  status, !status, 10, 100);
 	if (ret)
-		return ret;
+		goto err_pm;
 
 	ret = request_irq(c->irq, mtk_uart_apdma_irq_handler,
 			  IRQF_TRIGGER_NONE, KBUILD_MODNAME, chan);
 	if (ret < 0) {
 		dev_err(chan->device->dev, "Can't request dma IRQ\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_pm;
 	}
 
 	if (mtkd->support_33bits)
 		mtk_uart_apdma_write(c, VFF_4G_SUPPORT, VFF_4G_SUPPORT_CLR_B);
 
+err_pm:
+	pm_runtime_put_noidle(mtkd->ddev.dev);
 	return ret;
 }