Commit 1dbd83f3 authored Mar 22, 2020 by Liam Mark

arm64: dma_mapping: dma-mapping: Fix leak of dma_iommu_mapping



Currently arm_iommu_attach_device increments the reference count of the
dma_iommu_mapping object but arm_iommu_detach_device does not decrement
the reference count. This means that if a client calls
arm_iommu_attach_device/arm_iommu_detach_device more than once before
calling arm_iommu_release_mapping then the dma_iommu_mapping object will
be leaked.

We don't support having multiple devices attached to the same domain
concurently. So fix this issue by having neither arm_iommu_attach_device
or arm_iommu_detach_device change the reference count of the
dma_iommu_mapping object as that seems to have been the intension of the
original commit 1748f086a39c ("arm64: dma-mapping: Support attach after
detach case").

Change-Id: If21990ef1357742426503f71a9ff77aa0813668e
Signed-off-by: Liam Mark <lmark@codeaurora.org>

parent 83b2445d

arch/arm/mm/dma-mapping.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -2497,10 +2497,8 @@ static int arm_iommu_init_mapping(struct device *dev,
		u64 size = mapping->bits << PAGE_SHIFT;
		int is_fast = 0;

		if (mapping->init) {
		kref_get(&mapping->kref);
		if (mapping->init)
		return 0;
		}

		/* currently only 32-bit DMA address space is supported */
		if (size > DMA_BIT_MASK(32) + 1) {

arch/arm64/mm/dma-mapping.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -2095,10 +2095,8 @@ static int arm_iommu_init_mapping(struct device *dev,
		int s1_bypass = 0, is_fast = 0, is_bitmap = 0;
		dma_addr_t iova_end;

		if (mapping->init) {
		kref_get(&mapping->kref);
		if (mapping->init)
		return 0;
		}

		iova_end = mapping->base + (mapping->bits << PAGE_SHIFT) - 1;
		if (iova_end > dma_get_mask(dev)) {