Merge "ion: fix memory leak with non cp flag based ion alloc" (084729e3) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/dma-buf/dma-buf.c

+4 −4

Original line number	Original line	Diff line number	Diff line
	@@ -1320,7 +1320,7 @@ static void free_proc(struct dma_proc *proc)
	struct dma_info tmp, n;		struct dma_info tmp, n;

	list_for_each_entry_safe(tmp, n, &proc->dma_bufs, head) {		list_for_each_entry_safe(tmp, n, &proc->dma_bufs, head) {
	dma_buf_put(tmp->dmabuf);		fput(tmp->dmabuf->file);
	list_del(&tmp->head);		list_del(&tmp->head);
	kfree(tmp);		kfree(tmp);
	}		}
	@@ -1353,14 +1353,14 @@ static int dma_procs_debug_show(struct seq_file s, void unused)
	struct dma_proc tmp, n;		struct dma_proc tmp, n;
	LIST_HEAD(plist);		LIST_HEAD(plist);

	read_lock(&tasklist_lock);		rcu_read_lock();
	for_each_process(task) {		for_each_process(task) {
	struct files_struct *group_leader_files = NULL;		struct files_struct *group_leader_files = NULL;

	tmp = kzalloc(sizeof(*tmp), GFP_ATOMIC);		tmp = kzalloc(sizeof(*tmp), GFP_ATOMIC);
	if (!tmp) {		if (!tmp) {
	ret = -ENOMEM;		ret = -ENOMEM;
	read_unlock(&tasklist_lock);		rcu_read_unlock();
	goto mem_err;		goto mem_err;
	}		}
	INIT_LIST_HEAD(&tmp->dma_bufs);		INIT_LIST_HEAD(&tmp->dma_bufs);
	@@ -1384,7 +1384,7 @@ static int dma_procs_debug_show(struct seq_file s, void unused)
	skip:		skip:
	free_proc(tmp);		free_proc(tmp);
	}		}
	read_unlock(&tasklist_lock);		rcu_read_unlock();

	list_sort(NULL, &plist, proccmp);		list_sort(NULL, &plist, proccmp);
	list_for_each_entry(tmp, &plist, head)		list_for_each_entry(tmp, &plist, head)

drivers/iommu/arm-smmu-regs.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -193,6 +193,7 @@ enum arm_smmu_s2cr_privcfg {
	#define ARM_SMMU_CB_ATSR 0x8f0		#define ARM_SMMU_CB_ATSR 0x8f0
	#define ARM_SMMU_STATS_SYNC_INV_TBU_ACK 0x25dc		#define ARM_SMMU_STATS_SYNC_INV_TBU_ACK 0x25dc
	#define ARM_SMMU_TBU_PWR_STATUS 0x2204		#define ARM_SMMU_TBU_PWR_STATUS 0x2204
			#define ARM_SMMU_MMU2QSS_AND_SAFE_WAIT_CNTR 0x2670

	#define SCTLR_MEM_ATTR_SHIFT 16		#define SCTLR_MEM_ATTR_SHIFT 16
	#define SCTLR_SHCFG_SHIFT 22		#define SCTLR_SHCFG_SHIFT 22

drivers/iommu/arm-smmu.c

+9 −8

Original line number	Original line	Diff line number	Diff line
	@@ -1100,7 +1100,7 @@ static int __arm_smmu_tlb_sync(struct arm_smmu_device *smmu,
	void __iomem sync, void __iomem status)		void __iomem sync, void __iomem status)
	{		{
	unsigned int spin_cnt, delay;		unsigned int spin_cnt, delay;
	u32 sync_inv_ack, tbu_pwr_status;		u32 sync_inv_ack, tbu_pwr_status, sync_inv_progress;

	writel_relaxed(0, sync);		writel_relaxed(0, sync);
	for (delay = 1; delay < TLB_LOOP_TIMEOUT; delay *= 2) {		for (delay = 1; delay < TLB_LOOP_TIMEOUT; delay *= 2) {
	@@ -1115,10 +1115,12 @@ static int __arm_smmu_tlb_sync(struct arm_smmu_device *smmu,
	ARM_SMMU_STATS_SYNC_INV_TBU_ACK));		ARM_SMMU_STATS_SYNC_INV_TBU_ACK));
	tbu_pwr_status = scm_io_read((unsigned long)(smmu->phys_addr +		tbu_pwr_status = scm_io_read((unsigned long)(smmu->phys_addr +
	ARM_SMMU_TBU_PWR_STATUS));		ARM_SMMU_TBU_PWR_STATUS));
			sync_inv_progress = scm_io_read((unsigned long)(smmu->phys_addr +
			ARM_SMMU_MMU2QSS_AND_SAFE_WAIT_CNTR));
	trace_tlbsync_timeout(smmu->dev, 0);		trace_tlbsync_timeout(smmu->dev, 0);
	dev_err_ratelimited(smmu->dev,		dev_err_ratelimited(smmu->dev,
	"TLB sync timed out -- SMMU may be deadlocked ack 0x%x pwr 0x%x\n",		"TLB sync timed out -- SMMU may be deadlocked ack 0x%x pwr 0x%x sync and invalidation progress 0x%x\n",
	sync_inv_ack, tbu_pwr_status);		sync_inv_ack, tbu_pwr_status, sync_inv_progress);
	BUG_ON(IS_ENABLED(CONFIG_IOMMU_TLBSYNC_DEBUG));		BUG_ON(IS_ENABLED(CONFIG_IOMMU_TLBSYNC_DEBUG));
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -1550,15 +1552,14 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
	resume = RESUME_TERMINATE;		resume = RESUME_TERMINATE;
	} else {		} else {
	if (__ratelimit(&_rs)) {		if (__ratelimit(&_rs)) {
	phys_addr_t phys_atos = arm_smmu_verify_fault(domain,		phys_addr_t phys_atos;
	iova,
	fsr);

			print_ctx_regs(smmu, cfg, fsr);
			phys_atos = arm_smmu_verify_fault(domain, iova, fsr);
	dev_err(smmu->dev,		dev_err(smmu->dev,
	"Unhandled context fault: iova=0x%08lx, cb=%d, fsr=0x%x, fsynr0=0x%x, fsynr1=0x%x\n",		"Unhandled context fault: iova=0x%08lx, cb=%d, fsr=0x%x, fsynr0=0x%x, fsynr1=0x%x\n",
	iova, cfg->cbndx, fsr, fsynr0, fsynr1);		iova, cfg->cbndx, fsr, fsynr0, fsynr1);

	print_ctx_regs(smmu, cfg, fsr);

	dev_err(smmu->dev,		dev_err(smmu->dev,
	"soft iova-to-phys=%pa\n", &phys_soft);		"soft iova-to-phys=%pa\n", &phys_soft);
	@@ -2978,7 +2979,7 @@ static uint64_t arm_smmu_iova_to_pte(struct iommu_domain *domain,
	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);		struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
	struct io_pgtable_ops *ops = smmu_domain->pgtbl_ops;		struct io_pgtable_ops *ops = smmu_domain->pgtbl_ops;

	if (!ops)		if (!ops \|\| !ops->iova_to_pte)
	return 0;		return 0;

	spin_lock_irqsave(&smmu_domain->cb_lock, flags);		spin_lock_irqsave(&smmu_domain->cb_lock, flags);

drivers/staging/android/ion/ion_cma_heap.c

+12 −3

Original line number	Original line	Diff line number	Diff line
	@@ -3,7 +3,7 @@
	* Copyright (C) Linaro 2012		* Copyright (C) Linaro 2012
	* Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.		* Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
	*		*
	* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.		* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
	*/		*/

	#include <linux/device.h>		#include <linux/device.h>
	@@ -150,6 +150,9 @@ static int ion_secure_cma_allocate(struct ion_heap *heap,
	{		{
	int ret;		int ret;

			if (!(flags & ION_FLAGS_CP_MASK))
			return -EINVAL;

	ret = ion_cma_allocate(heap, buffer, len, flags);		ret = ion_cma_allocate(heap, buffer, len, flags);
	if (ret) {		if (ret) {
	dev_err(heap->priv, "Unable to allocate cma buffer");		dev_err(heap->priv, "Unable to allocate cma buffer");
	@@ -157,8 +160,14 @@ static int ion_secure_cma_allocate(struct ion_heap *heap,
	}		}

	ret = ion_hyp_assign_sg_from_flags(buffer->sg_table, flags, true);		ret = ion_hyp_assign_sg_from_flags(buffer->sg_table, flags, true);
	if (ret)		if (ret) {
			if (ret == -EADDRNOTAVAIL) {
	goto out_free_buf;		goto out_free_buf;
			} else {
			ion_cma_free(buffer);
			goto out;
			}
			}

	return ret;		return ret;

drivers/staging/android/ion/ion_secure_util.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -77,6 +77,9 @@ static int populate_vm_list(unsigned long flags, unsigned int *vm_list,
	int vmid;		int vmid;

	flags = flags & ION_FLAGS_CP_MASK;		flags = flags & ION_FLAGS_CP_MASK;
			if (!flags)
			return -EINVAL;

	for_each_set_bit(itr, &flags, BITS_PER_LONG) {		for_each_set_bit(itr, &flags, BITS_PER_LONG) {
	vmid = get_vmid(0x1UL << itr);		vmid = get_vmid(0x1UL << itr);
	if (vmid < 0 \|\| !nelems)		if (vmid < 0 \|\| !nelems)