Skip to content

Commit 28e8b74

Browse files
hlrichardsonChristoph Hellwig
authored andcommitted
dma: fix call order in dmam_free_coherent
dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. Tested: kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03 Fixes: 9ac7849 ("devres: device resource management") Signed-off-by: Lance Richardson <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]>
1 parent b69bdba commit 28e8b74

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

kernel/dma/mapping.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,8 @@ void dmam_free_coherent(struct device *dev, size_t size, void *vaddr,
6767
{
6868
struct dma_devres match_data = { size, vaddr, dma_handle };
6969

70-
dma_free_coherent(dev, size, vaddr, dma_handle);
7170
WARN_ON(devres_destroy(dev, dmam_release, dmam_match, &match_data));
71+
dma_free_coherent(dev, size, vaddr, dma_handle);
7272
}
7373
EXPORT_SYMBOL(dmam_free_coherent);
7474

0 commit comments

Comments
 (0)