Commit 6a8b02ea authored Feb 02, 2021 by Geert Uytterhoeven Committed by Greg Kroah-Hartman Mar 17, 2021

PCI: Fix pci_register_io_range() memory leak

[ Upstream commit f6bda644fa3a7070621c3bf12cd657f69a42f170 ]

Kmemleak reports:

  unreferenced object 0xc328de40 (size 64):
    comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00  ................
      00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00  ................

  backtrace:
    [<ad758d10>] pci_register_io_range+0x3c/0x80
    [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0
    [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac
    [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8
    [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64
    [<e451ddb0>] rcar_pcie_probe+0x2c/0x644

In case a PCI host driver's probe is deferred, the same I/O range may be
allocated again, and be ignored, causing a memory leak.

Fix this by (a) letting logic_pio_register_range() return -EEXIST if the
passed range already exists, so pci_register_io_range() will free it, and
by (b) making pci_register_io_range() not consider -EEXIST an error
condition.

Link: https://lore.kernel.org/r/20210202100332.829047-1-geert+renesas@glider.be


Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent b63a6e16

drivers/pci/pci.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -3817,6 +3817,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
		ret = logic_pio_register_range(range);
		if (ret)
		kfree(range);

		/* Ignore duplicates due to deferred probing */
		if (ret == -EEXIST)
		ret = 0;
		#endif

		return ret;

lib/logic_pio.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -27,6 +27,8 @@ static DEFINE_MUTEX(io_range_mutex);
		* @new_range: pointer to the IO range to be registered.
		*
		* Returns 0 on success, the error code in case of failure.
		* If the range already exists, -EEXIST will be returned, which should be
		* considered a success.
		*
		* Register a new IO range node in the IO range list.
		*/
		@@ -49,6 +51,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
		list_for_each_entry(range, &io_range_list, list) {
		if (range->fwnode == new_range->fwnode) {
		/* range already there */
		ret = -EEXIST;
		goto end_register;
		}
		if (range->flags == LOGIC_PIO_CPU_MMIO &&