diff mbox series

[2/2] PCI: rcar: Resolve of_find_matching_node() reference leak

Message ID 20220622025732.1359389-3-helgaas@kernel.org (mailing list archive)
State Under Review
Delegated to: Geert Uytterhoeven
Headers show
Series PCI: rcar: Fix of_find_matching_node() reference leak | expand

Commit Message

Bjorn Helgaas June 22, 2022, 2:57 a.m. UTC 
From: Bjorn Helgaas <bhelgaas@google.com>

Previously, rcar_pcie_init() used of_find_matching_node() to search the
entire device tree for compatible strings for which we need to install an
abort handler.  If we found one, we got a device_node with refcount
incremented, but we discarded the pointer and never released that
reference.

Extend the struct rcar_variant to indicate whether each variant requires an
abort handler.  Install the handler in rcar_pcie_probe() when needed.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Liang He <windhl@126.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
---
 drivers/pci/controller/pcie-rcar-host.c | 60 +++++++++++--------------
 1 file changed, 27 insertions(+), 33 deletions(-)

Comments

Geert Uytterhoeven June 22, 2022, 7:45 a.m. UTC | #1 
Hi Bjorn,

On Wed, Jun 22, 2022 at 4:57 AM Bjorn Helgaas <helgaas@kernel.org> wrote:
> From: Bjorn Helgaas <bhelgaas@google.com>
>
> Previously, rcar_pcie_init() used of_find_matching_node() to search the
> entire device tree for compatible strings for which we need to install an
> abort handler.  If we found one, we got a device_node with refcount
> incremented, but we discarded the pointer and never released that
> reference.
>
> Extend the struct rcar_variant to indicate whether each variant requires an
> abort handler.  Install the handler in rcar_pcie_probe() when needed.
>
> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> Cc: Liang He <windhl@126.com>
> Cc: Geert Uytterhoeven <geert@linux-m68k.org>

Thanks for your patch!

> --- a/drivers/pci/controller/pcie-rcar-host.c
> +++ b/drivers/pci/controller/pcie-rcar-host.c

> @@ -964,12 +965,35 @@ static int rcar_pcie_parse_map_dma_ranges(struct rcar_pcie_host *host)
>         return err;
>  }
>
> +#ifdef CONFIG_ARM
> +static int rcar_pcie_aarch32_abort_handler(unsigned long addr,
> +               unsigned int fsr, struct pt_regs *regs)
> +{
> +       return !fixup_exception(regs);
> +}
> +#endif
> +
> +static void rcar_pcie_hook_aborts(void)
> +{
> +#ifdef CONFIG_ARM
> +#ifdef CONFIG_ARM_LPAE
> +       hook_fault_code(17, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
> +                       "asynchronous external abort");
> +#else
> +       hook_fault_code(22, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
> +                       "imprecise external abort");
> +#endif
> +#endif
> +}
> +
>  static const struct rcar_variant rcar_h1_data = {
>         .phy_init_fn = rcar_pcie_phy_init_h1,
> +       .hook_aborts = true,
>  };
>
>  static const struct rcar_variant rcar_gen2_data = {
>         .phy_init_fn = rcar_pcie_phy_init_gen2,
> +       .hook_aborts = true,
>  };
>
>  static const struct rcar_variant rcar_gen3_data = {
> @@ -1035,6 +1059,9 @@ static int rcar_pcie_probe(struct platform_device *pdev)
>                 goto err_clk_disable;
>         }
>
> +       if (host->variant->hook_aborts)
> +               rcar_pcie_hook_aborts();

I was quite sure there was a good reason why this was not done in
.probe() before...

And indeed, the original submission[1] did have a comment explaining
that:

    + /*
    + * Since probe() can be deferred we need to make sure that
    + * hook_fault_code is not called after __init memory is freed
    + * by kernel and since rcar_pcie_abort_handler() is a no-op,
    + * we can install the handler here without risking it
    + * accessing some uninitialized driver state.
    + */

No idea why it was removed in v2 and later, but the point is:
hook_fault_code() is __init, so you cannot call it from a deferred
probe.
And you should have got a section mismatch warning ;-)

[1] https://lore.kernel.org/all/20200912211853.15321-1-marek.vasut@gmail.com/

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
Bjorn Helgaas June 22, 2022, 11:05 a.m. UTC | #2 
On Wed, Jun 22, 2022 at 09:45:49AM +0200, Geert Uytterhoeven wrote:
> Hi Bjorn,
> 
> On Wed, Jun 22, 2022 at 4:57 AM Bjorn Helgaas <helgaas@kernel.org> wrote:
> > From: Bjorn Helgaas <bhelgaas@google.com>
> >
> > Previously, rcar_pcie_init() used of_find_matching_node() to search the
> > entire device tree for compatible strings for which we need to install an
> > abort handler.  If we found one, we got a device_node with refcount
> > incremented, but we discarded the pointer and never released that
> > reference.
> >
> > Extend the struct rcar_variant to indicate whether each variant requires an
> > abort handler.  Install the handler in rcar_pcie_probe() when needed.
> >
> > Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> > Cc: Liang He <windhl@126.com>
> > Cc: Geert Uytterhoeven <geert@linux-m68k.org>
> 
> Thanks for your patch!
> 
> > --- a/drivers/pci/controller/pcie-rcar-host.c
> > +++ b/drivers/pci/controller/pcie-rcar-host.c
> 
> > @@ -964,12 +965,35 @@ static int rcar_pcie_parse_map_dma_ranges(struct rcar_pcie_host *host)
> >         return err;
> >  }
> >
> > +#ifdef CONFIG_ARM
> > +static int rcar_pcie_aarch32_abort_handler(unsigned long addr,
> > +               unsigned int fsr, struct pt_regs *regs)
> > +{
> > +       return !fixup_exception(regs);
> > +}
> > +#endif
> > +
> > +static void rcar_pcie_hook_aborts(void)
> > +{
> > +#ifdef CONFIG_ARM
> > +#ifdef CONFIG_ARM_LPAE
> > +       hook_fault_code(17, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
> > +                       "asynchronous external abort");
> > +#else
> > +       hook_fault_code(22, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
> > +                       "imprecise external abort");
> > +#endif
> > +#endif
> > +}
> > +
> >  static const struct rcar_variant rcar_h1_data = {
> >         .phy_init_fn = rcar_pcie_phy_init_h1,
> > +       .hook_aborts = true,
> >  };
> >
> >  static const struct rcar_variant rcar_gen2_data = {
> >         .phy_init_fn = rcar_pcie_phy_init_gen2,
> > +       .hook_aborts = true,
> >  };
> >
> >  static const struct rcar_variant rcar_gen3_data = {
> > @@ -1035,6 +1059,9 @@ static int rcar_pcie_probe(struct platform_device *pdev)
> >                 goto err_clk_disable;
> >         }
> >
> > +       if (host->variant->hook_aborts)
> > +               rcar_pcie_hook_aborts();
> 
> I was quite sure there was a good reason why this was not done in
> .probe() before...
> 
> And indeed, the original submission[1] did have a comment explaining
> that:
> 
>     + /*
>     + * Since probe() can be deferred we need to make sure that
>     + * hook_fault_code is not called after __init memory is freed
>     + * by kernel and since rcar_pcie_abort_handler() is a no-op,
>     + * we can install the handler here without risking it
>     + * accessing some uninitialized driver state.
>     + */
> 
> No idea why it was removed in v2 and later, but the point is:
> hook_fault_code() is __init, so you cannot call it from a deferred
> probe.
> And you should have got a section mismatch warning ;-)

Oooh, thanks for that!  I missed the builtin_platform_driver_probe()
vs builtin_platform_driver() difference that explains why doing this
at probe-time works for pci-ixp4xx.c but not here.

Bjorn
diff mbox series

Patch

diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
index ccf13aafa1e5..139a0274b9e0 100644
--- a/drivers/pci/controller/pcie-rcar-host.c
+++ b/drivers/pci/controller/pcie-rcar-host.c
@@ -60,6 +60,7 @@  struct rcar_pcie_host;
 
 struct rcar_variant {
 	int	(*phy_init_fn)(struct rcar_pcie_host *host);
+	bool	hook_aborts;
 };
 
 /* Structure representing the PCIe interface */
@@ -964,12 +965,35 @@  static int rcar_pcie_parse_map_dma_ranges(struct rcar_pcie_host *host)
 	return err;
 }
 
+#ifdef CONFIG_ARM
+static int rcar_pcie_aarch32_abort_handler(unsigned long addr,
+		unsigned int fsr, struct pt_regs *regs)
+{
+	return !fixup_exception(regs);
+}
+#endif
+
+static void rcar_pcie_hook_aborts(void)
+{
+#ifdef CONFIG_ARM
+#ifdef CONFIG_ARM_LPAE
+	hook_fault_code(17, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
+			"asynchronous external abort");
+#else
+	hook_fault_code(22, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
+			"imprecise external abort");
+#endif
+#endif
+}
+
 static const struct rcar_variant rcar_h1_data = {
 	.phy_init_fn = rcar_pcie_phy_init_h1,
+	.hook_aborts = true,
 };
 
 static const struct rcar_variant rcar_gen2_data = {
 	.phy_init_fn = rcar_pcie_phy_init_gen2,
+	.hook_aborts = true,
 };
 
 static const struct rcar_variant rcar_gen3_data = {
@@ -1035,6 +1059,9 @@  static int rcar_pcie_probe(struct platform_device *pdev)
 		goto err_clk_disable;
 	}
 
+	if (host->variant->hook_aborts)
+		rcar_pcie_hook_aborts();
+
 	/* Failure to get a link might just be that no cards are inserted */
 	if (rcar_pcie_hw_init(pcie)) {
 		dev_info(dev, "PCIe link down\n");
@@ -1153,37 +1180,4 @@  static struct platform_driver rcar_pcie_driver = {
 	},
 	.probe = rcar_pcie_probe,
 };
-
-#ifdef CONFIG_ARM
-static int rcar_pcie_aarch32_abort_handler(unsigned long addr,
-		unsigned int fsr, struct pt_regs *regs)
-{
-	return !fixup_exception(regs);
-}
-
-static const struct of_device_id rcar_pcie_abort_handler_of_match[] __initconst = {
-	{ .compatible = "renesas,pcie-r8a7779" },
-	{ .compatible = "renesas,pcie-r8a7790" },
-	{ .compatible = "renesas,pcie-r8a7791" },
-	{ .compatible = "renesas,pcie-rcar-gen2" },
-	{},
-};
-
-static int __init rcar_pcie_init(void)
-{
-	if (of_find_matching_node(NULL, rcar_pcie_abort_handler_of_match)) {
-#ifdef CONFIG_ARM_LPAE
-		hook_fault_code(17, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
-				"asynchronous external abort");
-#else
-		hook_fault_code(22, rcar_pcie_aarch32_abort_handler, SIGBUS, 0,
-				"imprecise external abort");
-#endif
-	}
-
-	return platform_driver_register(&rcar_pcie_driver);
-}
-device_initcall(rcar_pcie_init);
-#else
 builtin_platform_driver(rcar_pcie_driver);
-#endif