| From foo@baz Wed Aug 22 09:42:09 CEST 2018 |
| From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| Date: Wed, 18 Jul 2018 15:40:40 -0500 |
| Subject: PCI: versatile: Fix I/O space page leak |
| |
| From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| |
| [ Upstream commit 0018b265adf7e251f90d3ca1c7c0e32e2a0ad262 ] |
| |
| When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY |
| driver was left disabled, the kernel crashed with this BUG: |
| |
| kernel BUG at lib/ioremap.c:72! |
| Internal error: Oops - BUG: 0 [#1] PREEMPT SMP |
| Modules linked in: |
| CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 |
| Hardware name: Renesas Condor board based on r8a77980 (DT) |
| Workqueue: events deferred_probe_work_func |
| pstate: 80000005 (Nzcv daif -PAN -UAO) |
| pc : ioremap_page_range+0x370/0x3c8 |
| lr : ioremap_page_range+0x40/0x3c8 |
| sp : ffff000008da39e0 |
| x29: ffff000008da39e0 x28: 00e8000000000f07 |
| x27: ffff7dfffee00000 x26: 0140000000000000 |
| x25: ffff7dfffef00000 x24: 00000000000fe100 |
| x23: ffff80007b906000 x22: ffff000008ab8000 |
| x21: ffff000008bb1d58 x20: ffff7dfffef00000 |
| x19: ffff800009c30fb8 x18: 0000000000000001 |
| x17: 00000000000152d0 x16: 00000000014012d0 |
| x15: 0000000000000000 x14: 0720072007200720 |
| x13: 0720072007200720 x12: 0720072007200720 |
| x11: 0720072007300730 x10: 00000000000000ae |
| x9 : 0000000000000000 x8 : ffff7dffff000000 |
| x7 : 0000000000000000 x6 : 0000000000000100 |
| x5 : 0000000000000000 x4 : 000000007b906000 |
| x3 : ffff80007c61a880 x2 : ffff7dfffeefffff |
| x1 : 0000000040000000 x0 : 00e80000fe100f07 |
| Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) |
| Call trace: |
| ioremap_page_range+0x370/0x3c8 |
| pci_remap_iospace+0x7c/0xac |
| pci_parse_request_of_pci_ranges+0x13c/0x190 |
| rcar_pcie_probe+0x4c/0xb04 |
| platform_drv_probe+0x50/0xbc |
| driver_probe_device+0x21c/0x308 |
| __device_attach_driver+0x98/0xc8 |
| bus_for_each_drv+0x54/0x94 |
| __device_attach+0xc4/0x12c |
| device_initial_probe+0x10/0x18 |
| bus_probe_device+0x90/0x98 |
| deferred_probe_work_func+0xb0/0x150 |
| process_one_work+0x12c/0x29c |
| worker_thread+0x200/0x3fc |
| kthread+0x108/0x134 |
| ret_from_fork+0x10/0x18 |
| Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) |
| |
| It turned out that pci_remap_iospace() wasn't undone when the driver's |
| probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, |
| the probe was retried, finally causing the BUG due to trying to remap |
| already remapped pages. |
| |
| The Versatile PCI controller driver has the same issue. |
| Replace pci_remap_iospace() with the devm_ managed version to fix the bug. |
| |
| Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver") |
| Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| [lorenzo.pieralisi@arm.com: updated the commit log] |
| Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> |
| Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> |
| Reviewed-by: Linus Walleij <linus.walleij@linaro.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/pci/host/pci-versatile.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/pci/host/pci-versatile.c |
| +++ b/drivers/pci/host/pci-versatile.c |
| @@ -89,7 +89,7 @@ static int versatile_pci_parse_request_o |
| |
| switch (resource_type(res)) { |
| case IORESOURCE_IO: |
| - err = pci_remap_iospace(res, iobase); |
| + err = devm_pci_remap_iospace(dev, res, iobase); |
| if (err) { |
| dev_warn(dev, "error %d: failed to map resource %pR\n", |
| err, res); |
