| From 36226f6738ce3313a9956b16db332be106a28017 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 23 Jul 2021 18:01:08 +0530 |
| Subject: dma-buf: WARN on dmabuf release with pending attachments |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Charan Teja Reddy <charante@codeaurora.org> |
| |
| [ Upstream commit f492283b157053e9555787262f058ae33096f568 ] |
| |
| It is expected from the clients to follow the below steps on an imported |
| dmabuf fd: |
| a) dmabuf = dma_buf_get(fd) // Get the dmabuf from fd |
| b) dma_buf_attach(dmabuf); // Clients attach to the dmabuf |
| o Here the kernel does some slab allocations, say for |
| dma_buf_attachment and may be some other slab allocation in the |
| dmabuf->ops->attach(). |
| c) Client may need to do dma_buf_map_attachment(). |
| d) Accordingly dma_buf_unmap_attachment() should be called. |
| e) dma_buf_detach () // Clients detach to the dmabuf. |
| o Here the slab allocations made in b) are freed. |
| f) dma_buf_put(dmabuf) // Can free the dmabuf if it is the last |
| reference. |
| |
| Now say an erroneous client failed at step c) above thus it directly |
| called dma_buf_put(), step f) above. Considering that it may be the last |
| reference to the dmabuf, buffer will be freed with pending attachments |
| left to the dmabuf which can show up as the 'memory leak'. This should |
| at least be reported as the WARN(). |
| |
| Signed-off-by: Charan Teja Reddy <charante@codeaurora.org> |
| Reviewed-by: Christian König <christian.koenig@amd.com> |
| Link: https://patchwork.freedesktop.org/patch/msgid/1627043468-16381-1-git-send-email-charante@codeaurora.org |
| Signed-off-by: Christian König <christian.koenig@amd.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/dma-buf/dma-buf.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c |
| index 758de0e9b2ddc..16bbc9bc9e6d1 100644 |
| --- a/drivers/dma-buf/dma-buf.c |
| +++ b/drivers/dma-buf/dma-buf.c |
| @@ -79,6 +79,7 @@ static void dma_buf_release(struct dentry *dentry) |
| if (dmabuf->resv == (struct dma_resv *)&dmabuf[1]) |
| dma_resv_fini(dmabuf->resv); |
| |
| + WARN_ON(!list_empty(&dmabuf->attachments)); |
| module_put(dmabuf->owner); |
| kfree(dmabuf->name); |
| kfree(dmabuf); |
| -- |
| 2.33.0 |
| |