git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 7692c9fbedd9087dc9050903f58095915458d9b1 Mon Sep 17 00:00:00 2001
   2 From: Xiaolei Wang <xiaolei.wang@windriver.com>
   3 Date: Wed, 30 Apr 2025 17:20:42 +0800
   4 Subject: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
   5
   6 From: Xiaolei Wang <xiaolei.wang@windriver.com>
   7
   8 commit 7692c9fbedd9087dc9050903f58095915458d9b1 upstream.
   9
  10 When rproc->state = RPROC_DETACHED and rproc_attach() is used
  11 to attach to the remote processor, if rproc_handle_resources()
  12 returns a failure, the resources allocated by imx_rproc_prepare()
  13 should be released, otherwise the following memory leak will occur.
  14
  15 Since almost the same thing is done in imx_rproc_prepare() and
  16 rproc_resource_cleanup(), Function rproc_resource_cleanup() is able
  17 to deal with empty lists so it is better to fix the "goto" statements
  18 in rproc_attach(). replace the "unprepare_device" goto statement with
  19 "clean_up_resources" and get rid of the "unprepare_device" label.
  20
  21 unreferenced object 0xffff0000861c5d00 (size 128):
  22 comm "kworker/u12:3", pid 59, jiffies 4294893509 (age 149.220s)
  23 hex dump (first 32 bytes):
  24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  25 00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............
  26 backtrace:
  27  [<00000000f949fe18>] slab_post_alloc_hook+0x98/0x37c
  28  [<00000000adbfb3e7>] __kmem_cache_alloc_node+0x138/0x2e0
  29  [<00000000521c0345>] kmalloc_trace+0x40/0x158
  30  [<000000004e330a49>] rproc_mem_entry_init+0x60/0xf8
  31  [<000000002815755e>] imx_rproc_prepare+0xe0/0x180
  32  [<0000000003f61b4e>] rproc_boot+0x2ec/0x528
  33  [<00000000e7e994ac>] rproc_add+0x124/0x17c
  34  [<0000000048594076>] imx_rproc_probe+0x4ec/0x5d4
  35  [<00000000efc298a1>] platform_probe+0x68/0xd8
  36  [<00000000110be6fe>] really_probe+0x110/0x27c
  37  [<00000000e245c0ae>] __driver_probe_device+0x78/0x12c
  38  [<00000000f61f6f5e>] driver_probe_device+0x3c/0x118
  39  [<00000000a7874938>] __device_attach_driver+0xb8/0xf8
  40  [<0000000065319e69>] bus_for_each_drv+0x84/0xe4
  41  [<00000000db3eb243>] __device_attach+0xfc/0x18c
  42  [<0000000072e4e1a4>] device_initial_probe+0x14/0x20
  43
  44 Fixes: 10a3d4079eae ("remoteproc: imx_rproc: move memory parsing to rproc_ops")
  45 Suggested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
  46 Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
  47 Reviewed-by: Peng Fan <peng.fan@nxp.com>
  48 Cc: stable@vger.kernel.org
  49 Link: https://lore.kernel.org/r/20250430092043.1819308-2-xiaolei.wang@windriver.com
  50 Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
  51 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  52 ---
  53  drivers/remoteproc/remoteproc_core.c |    5 ++---
  54  1 file changed, 2 insertions(+), 3 deletions(-)
  55
  56 --- a/drivers/remoteproc/remoteproc_core.c
  57 +++ b/drivers/remoteproc/remoteproc_core.c
  58 @@ -1726,7 +1726,7 @@ static int rproc_attach(struct rproc *rp
  59         ret = rproc_set_rsc_table(rproc);
  60         if (ret) {
  61                 dev_err(dev, "can't load resource table: %d\n", ret);
  62 -               goto unprepare_device;
  63 +               goto clean_up_resources;
  64         }
  65
  66         /* reset max_notifyid */
  67 @@ -1743,7 +1743,7 @@ static int rproc_attach(struct rproc *rp
  68         ret = rproc_handle_resources(rproc, rproc_loading_handlers);
  69         if (ret) {
  70                 dev_err(dev, "Failed to process resources: %d\n", ret);
  71 -               goto unprepare_device;
  72 +               goto clean_up_resources;
  73         }
  74
  75         /* Allocate carveout resources associated to rproc */
  76 @@ -1762,7 +1762,6 @@ static int rproc_attach(struct rproc *rp
  77
  78  clean_up_resources:
  79         rproc_resource_cleanup(rproc);
  80 -unprepare_device:
  81         /* release HW resources if needed */
  82         rproc_unprepare_device(rproc);
  83  disable_iommu: