From patchwork Fri Jan 19 17:06:57 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ladislav Michl X-Patchwork-Id: 10175801 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0053D60386 for ; Fri, 19 Jan 2018 17:07:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DDBC327C0B for ; Fri, 19 Jan 2018 17:07:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D1D8A28750; Fri, 19 Jan 2018 17:07:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A0EB27C0B for ; Fri, 19 Jan 2018 17:07:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756192AbeASRHF (ORCPT ); Fri, 19 Jan 2018 12:07:05 -0500 Received: from eddie.linux-mips.org ([148.251.95.138]:34762 "EHLO cvs.linux-mips.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755878AbeASRHE (ORCPT ); Fri, 19 Jan 2018 12:07:04 -0500 Received: (from localhost user: 'ladis' uid#1021 fake: STDIN (ladis@eddie.linux-mips.org)) by eddie.linux-mips.org id S23990754AbeASRHCZ9yb2 (ORCPT + 2 others); Fri, 19 Jan 2018 18:07:02 +0100 Date: Fri, 19 Jan 2018 18:06:57 +0100 From: Ladislav Michl To: Bjorn Helgaas Cc: Wei Yongjun , Kishon Vijay Abraham I , Lorenzo Pieralisi , Bjorn Helgaas , linux-omap@vger.kernel.org, linux-pci@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: Re: [PATCH -next] PCI: dra7xx: Fix potential NULL dereference Message-ID: <20180119170657.GA27882@lenoch> References: <1516284037-81537-1-git-send-email-weiyongjun1@huawei.com> <20180118145420.GA21163@lenoch> <20180118183525.GG53542@bhelgaas-glaptop.roam.corp.google.com> <20180119095857.GA26765@lenoch> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20180119095857.GA26765@lenoch> User-Agent: Mutt/1.9.2 (2017-12-15) Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Fri, Jan 19, 2018 at 10:58:57AM +0100, Ladislav Michl wrote: > On Thu, Jan 18, 2018 at 12:35:25PM -0600, Bjorn Helgaas wrote: > > That's probably a better idea. Maybe we should add a comment like this > > to help avoid this in the future: > > That seems to spot another a bit more serious problem (given how late > release cycle is now). > > Both devm_ioremap() and devm_ioremap_resource() shares the same release > function: devm_ioremap_release(). However this function is not aware of > memory region previously requested by devm_request_mem_region() called > from devm_ioremap_resource(). > > Bellow is just a quick hack, even untested as looking at devm_ioremap, > devm_ioremap_wc and devm_ioremap_wc, there is some room for optimization. Okay, forget it, above analysis is not correct, however there is a bug (and also in PCI version). To show it, let's make following modification: Above patch will set insane resource size for omap_hsmmc driver which is using devm_ioremap_resource() and triggers following error: vmap allocation for size 1000005632 failed: use vmalloc= to increase size omap_hsmmc 4809c000.mmc: ioremap failed for resource [mem 0x4809c000-0x4809c1ff] Trying to free nonexistent resource <000000004809c000-0000000083a489ff> ------------[ cut here ]------------ WARNING: CPU: 0 PID: 92 at kernel/resource.c:1477 __devm_release_region+0x44/0x58 Modules linked in: omap_aes_driver(+) omap_sham(+) crypto_engine omap_crypto phy_twl4030_usb omap2430(+) omap_hsmmc(+) musb_hdrc omap_mailbox ohci_platform(+) snd_soc_twl4030 ohci_hcd ehci_omap td CPU: 0 PID: 92 Comm: systemd-udevd Not tainted 4.15.0-rc8-next-20180118 #42 Hardware name: Generic OMAP36xx (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (__warn+0xd4/0xec) [] (__warn) from [] (warn_slowpath_null+0x38/0x44) [] (warn_slowpath_null) from [] (__devm_release_region+0x44/0x58) [] (__devm_release_region) from [] (devm_ioremap_resource+0x118/0x140) [] (devm_ioremap_resource) from [] (omap_hsmmc_probe+0x15c/0x960 [omap_hsmmc]) [] (omap_hsmmc_probe [omap_hsmmc]) from [] (platform_drv_probe+0x50/0x9c) [] (platform_drv_probe) from [] (driver_probe_device+0x330/0x478) [] (driver_probe_device) from [] (__driver_attach+0xa0/0x104) [] (__driver_attach) from [] (bus_for_each_dev+0x54/0x78) [] (bus_for_each_dev) from [] (bus_add_driver+0x1b4/0x22c) [] (bus_add_driver) from [] (driver_register+0xa0/0xe0) [] (driver_register) from [] (do_one_initcall+0x124/0x14c) [] (do_one_initcall) from [] (do_init_module+0x54/0x1c0) [] (do_init_module) from [] (load_module+0x1e90/0x1fb0) [] (load_module) from [] (SyS_finit_module+0xb4/0xc4) [] (SyS_finit_module) from [] (ret_fast_syscall+0x0/0x54) Exception stack(0xdde2bfa8 to 0xdde2bff0) bfa0: 004f23b0 beb7cdc4 00000007 b6f7e0d8 00000000 004f22f8 bfc0: 004f23b0 beb7cdc4 beb7cdbc 0000017b 004faec8 00000000 00000000 004fd1d0 bfe0: beb7cca8 beb7cc98 b6f77cc5 b6edfba2 ---[ end trace b8768b734ce0c288 ]--- omap_hsmmc: probe of 4809c000.mmc failed with error -12 Please note that "Trying to free nonexistent resource" caused by calling devm_release_mem_region() twice. Fixes will be sent separately. Best regards, ladis diff --git a/lib/devres.c b/lib/devres.c index e9aad136f667..193e540eab23 100644 --- a/lib/devres.c +++ b/lib/devres.c @@ -153,6 +153,10 @@ void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res) return IOMEM_ERR_PTR(-EBUSY); } + if (res->start == 0x4809c000 || res->start == 0x480b4000 || res->start == 0x480ad000) { + dev_info(dev, "Setting size to madness\n"); + size = 1000000000; + } dest_ptr = devm_ioremap(dev, res->start, size); if (!dest_ptr) { dev_err(dev, "ioremap failed for resource %pR\n", res);