lkml.org 
[lkml]   [2022]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] dmaengine: release channels on device unregister
    Date
    Currently if dma_async_device_unregister is invoked while some clients
    still hold a reference to some channels it would prevent device to be released
    which would leave dangling pointers inside dma_device_list and cause crashes
    in methods that tries to use it

    Fix it by force releasing channels which will allow device to be also released

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    PGD 0 P4D 0
    Oops: 0000 [#1] PREEMPT SMP NOPTI
    RIP: 0010:dma_issue_pending_all (drivers/dma/dmaengine.c:562)
    All code
    ========
    0: 45 20 49 8d and %r9b,-0x73(%r9)
    4: 55 push %rbp
    5: 20 4c 89 ed and %cl,-0x13(%rcx,%rcx,4)
    9: 48 83 e8 20 sub $0x20,%rax
    d: 48 81 fa e0 7a 18 b2 cmp $0xffffffffb2187ae0,%rdx
    14: 74 52 je 0x68
    16: 49 89 c5 mov %rax,%r13
    19: 48 8b 45 48 mov 0x48(%rbp),%rax
    1d: f6 c4 02 test $0x2,%ah
    20: 75 dc jne 0xfffffffffffffffe
    22: 48 8b 45 10 mov 0x10(%rbp),%rax
    26: 4c 8d 65 10 lea 0x10(%rbp),%r12
    2a:* 48 8b 08 mov (%rax),%rcx <-- trapping instruction
    2d: 48 8d 78 c8 lea -0x38(%rax),%rdi
    31: 48 8d 59 c8 lea -0x38(%rcx),%rbx
    35: 49 39 c4 cmp %rax,%r12
    38: 75 05 jne 0x3f
    3a: eb c2 jmp 0xfffffffffffffffe
    3c: 48 89 c3 mov %rax,%rbx
    3f: 8b .byte 0x8b

    RSP: 0018:ffff987e44a9fde0 EFLAGS: 00010246
    RAX: 0000000000000000 RBX: ffff8bdc410e6e00 RCX: 0000000000000000
    RDX: ffff8bdc41700e48 RSI: ffffffffb090de19 RDI: ffff8bdc410e6e00
    RBP: ffff8bdc41700e28 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000000 R12: ffff8bdc41700e38
    R13: ffffffffffffffe0 R14: ffff8bdc4b3e5000 R15: 0000000000000000
    FS: 0000000000000000(0000) GS:ffff8be39b380000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 000000018e1b6000 CR4: 00000000003506e0
    Call Trace:
    <TASK>
    raid5d (drivers/md/raid5.c:6563) raid456
    ? rcu_read_lock_sched_held (kernel/rcu/update.c:104 kernel/rcu/update.c:123)
    md_thread (drivers/md/md.c:7923) md_mod
    ? do_wait_intr (kernel/sched/wait.c:415)
    ? rdev_read_only.isra.0 (drivers/md/md.c:7887) md_mod
    kthread (kernel/kthread.c:377)
    ? kthread_complete_and_exit (kernel/kthread.c:332)
    ret_from_fork (arch/x86/entry/entry_64.S:301)
    </TASK>

    Signed-off-by: Dāvis Mosāns <davispuh@gmail.com>
    ---
    drivers/dma/dmaengine.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
    index 2cfa8458b51be..92d4d0522694c 100644
    --- a/drivers/dma/dmaengine.c
    +++ b/drivers/dma/dmaengine.c
    @@ -1112,6 +1112,9 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
    mutex_lock(&dma_list_mutex);
    device->chancnt--;
    chan->dev->chan = NULL;
    + while (chan->client_count) {
    + dma_chan_put(chan);
    + }
    mutex_unlock(&dma_list_mutex);
    mutex_lock(&device->chan_mutex);
    ida_free(&device->chan_ida, chan->chan_id);
    --
    2.35.1
    \
     
     \ /
      Last update: 2022-02-28 04:28    [W:20.213 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site