From patchwork Thu Jan 10 18:49:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Remi Pommarel X-Patchwork-Id: 10756627 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B3B9313B4 for ; Thu, 10 Jan 2019 18:41:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A368029C5A for ; Thu, 10 Jan 2019 18:41:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 94AF829C6D; Thu, 10 Jan 2019 18:41:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3860929C5A for ; Thu, 10 Jan 2019 18:41:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=SERgCQ+1yGA4dJbmIHziqSbwddmtHVuupuoq4IGL2mA=; b=URGcOy0106n9Yi 8w6BPiNnaD7tbqOiQmooz7yOXFhxqZZxoLh1GRsreKAq9UuXrZhfx/H74+bfvyDreUJwcBpdJftRr 1cPmCue7VSg7/cVkFu0rj8xCu/sGZaJeU/+PSrYyZiMjVsPJgDP8pbOVln8zh25O7M2iWLglg8CkZ vA+4fav5XwShSbxZXtkSL5eq79IzjUKbE8LIQ8qnlemEA0eHgL/FrMyIlKZC09h5//MNzPCUb+KCT UG99EAYP+PmUg+pj0lO7cFE85eF3FxxpDRKA+sTgi2tu2LRDb5BD82Ekl9AEljy8EkHK0jASmAmKR bsnyHNKjQUhrm8hkc2bg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1ghfGK-0002pa-KC; Thu, 10 Jan 2019 18:41:04 +0000 Received: from merlin.infradead.org ([2001:8b0:10b:1231::1]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1ghfGJ-0002pG-Ro for linux-amlogic@bombadil.infradead.org; Thu, 10 Jan 2019 18:41:03 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=Content-Transfer-Encoding:MIME-Version: Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=U3HCQlu52kLavno/YB+dfn90fwFxF0gMqTd49DNwwMw=; b=ZRwjWpd8XqGJ11axrNTx3u2Omn DnX6/XcE+mYkhqK/bdOZmZOM5bhGlytchNUqdlhwAM1V2cAkb89CCLOO3lmrUhYB7E2XZNmkGCfdT W53Zzfvutq4kch9nGP7JGoPJhTTzeKmpnPCZwt0uVF/QQmRaFiOF3rBjWBxKtwizZ48JpEwtJz6cF EPpY9YwnXGl/2M89/Hq7v0unt6CEzikktBgegx2sqNC+8M2PRzp7o/ZSyxFgEQXpsCucUTqJ5x0kF 7ykDNt4oCCz8fGnfNHufOcg2mebHU1oj1ZjGY9BtdfSGMjD+cIsnf7diEYAzszx/3H1phorZ34Ypo KV/MB0Vw==; Received: from relay5-d.mail.gandi.net ([217.70.183.197]) by merlin.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1ghfGF-0006V5-Kq for linux-amlogic@lists.infradead.org; Thu, 10 Jan 2019 18:41:01 +0000 X-Originating-IP: 88.190.179.123 Received: from localhost (unknown [88.190.179.123]) (Authenticated sender: repk@triplefau.lt) by relay5-d.mail.gandi.net (Postfix) with ESMTPSA id 830221C0007; Thu, 10 Jan 2019 18:40:24 +0000 (UTC) From: Remi Pommarel To: Ulf Hansson , Kevin Hilman Subject: [PATCH] mmc: meson-gx: Free irq in release() callback Date: Thu, 10 Jan 2019 19:49:08 +0100 Message-Id: <20190110184908.27413-1-repk@triplefau.lt> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190110_134059_787486_764DEBFC X-CRM114-Status: GOOD ( 10.13 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Elie Roudninski , linux-amlogic@lists.infradead.org, Remi Pommarel , linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+patchwork-linux-amlogic=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Because the irq was requested through device managed resources API (devm_request_threaded_irq()) it was freed after meson_mmc_remove() completion, thus after mmc_free_host() has reclaimed meson_host memory. As this irq is IRQF_SHARED, while using CONFIG_DEBUG_SHIRQ, its handler get called by free_irq(). So meson_mmc_irq() was called after the meson_host memory reclamation and was using invalid memory. We ended up with the following scenario: device_release_driver() meson_mmc_remove() mmc_free_host() /* Freeing host memory */ ... devres_release_all() devm_irq_release() __free_irq() meson_mmc_irq() /* Uses freed memory */ To avoid this, the irq is released in meson_mmc_remove() before mmc_free_host() gets called. This fixes https://marc.info/?l=linux-mmc&m=154707415208716. Signed-off-by: Remi Pommarel --- drivers/mmc/host/meson-gx-mmc.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c index c2690c1a50ff..412cfd16bf15 100644 --- a/drivers/mmc/host/meson-gx-mmc.c +++ b/drivers/mmc/host/meson-gx-mmc.c @@ -179,6 +179,8 @@ struct meson_host { struct sd_emmc_desc *descs; dma_addr_t descs_dma_addr; + int irq; + bool vqmmc_enabled; }; @@ -1231,7 +1233,7 @@ static int meson_mmc_probe(struct platform_device *pdev) struct resource *res; struct meson_host *host; struct mmc_host *mmc; - int ret, irq; + int ret; mmc = mmc_alloc_host(sizeof(struct meson_host), &pdev->dev); if (!mmc) @@ -1276,8 +1278,8 @@ static int meson_mmc_probe(struct platform_device *pdev) goto free_host; } - irq = platform_get_irq(pdev, 0); - if (irq <= 0) { + host->irq = platform_get_irq(pdev, 0); + if (host->irq <= 0) { dev_err(&pdev->dev, "failed to get interrupt resource.\n"); ret = -EINVAL; goto free_host; @@ -1331,9 +1333,8 @@ static int meson_mmc_probe(struct platform_device *pdev) writel(IRQ_CRC_ERR | IRQ_TIMEOUTS | IRQ_END_OF_CHAIN, host->regs + SD_EMMC_IRQ_EN); - ret = devm_request_threaded_irq(&pdev->dev, irq, meson_mmc_irq, - meson_mmc_irq_thread, IRQF_SHARED, - NULL, host); + ret = devm_request_threaded_irq(&pdev->dev, host->irq, meson_mmc_irq, + meson_mmc_irq_thread, IRQF_SHARED, NULL, host); if (ret) goto err_init_clk; @@ -1387,6 +1388,7 @@ static int meson_mmc_remove(struct platform_device *pdev) /* disable interrupts */ writel(0, host->regs + SD_EMMC_IRQ_EN); + devm_free_irq(host->dev, host->irq, host); dma_free_coherent(host->dev, SD_EMMC_DESC_BUF_LEN, host->descs, host->descs_dma_addr);