Commit 7c8f176d authored by Xiyu Yang's avatar Xiyu Yang Committed by Will Deacon
Browse files

iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation 



The reference counting issue happens in several exception handling paths
of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the
function forgets to decrease the refcount of "smmu" increased by
arm_smmu_rpm_get(), causing a refcount leak.

Fix this issue by jumping to "out" label when those error scenarios
occur.

Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
Reviewed-by: default avatarRob Clark <robdclark@chromium.org>
Link: https://lore.kernel.org/r/1623293391-17261-1-git-send-email-xiyuyang19@fudan.edu.cn


Signed-off-by: default avatarWill Deacon <will@kernel.org>
parent 1adf30f1

drivers/iommu/arm/arm-smmu/arm-smmu.c

+6 −2
Original line number Diff line number Diff line
@@ -1271,6 +1271,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, 
	u64 phys;

	unsigned long va, flags;

	int ret, idx = cfg->cbndx;

	phys_addr_t addr = 0;



	ret = arm_smmu_rpm_get(smmu);

	if (ret < 0)
@@ -1290,6 +1291,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, 
		dev_err(dev,

			"iova to phys timed out on %pad. Falling back to software table walk.\n",

			&iova);

		arm_smmu_rpm_put(smmu);

		return ops->iova_to_phys(ops, iova);

	}
@@ -1298,12 +1300,14 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, 
	if (phys & ARM_SMMU_CB_PAR_F) {

		dev_err(dev, "translation fault!\n");

		dev_err(dev, "PAR = 0x%llx\n", phys);

		return 0;

		goto out;

	}



	addr = (phys & GENMASK_ULL(39, 12)) | (iova & 0xfff);

out:

	arm_smmu_rpm_put(smmu);



	return (phys & GENMASK_ULL(39, 12)) | (iova & 0xfff);

	return addr;

}



static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,