linux-stable/kernel/dma
Lance Richardson 1fe97f68fc dma: fix call order in dmam_free_coherent
[ Upstream commit 28e8b7406d ]

dmam_free_coherent() frees a DMA allocation, which makes the
freed vaddr available for reuse, then calls devres_destroy()
to remove and free the data structure used to track the DMA
allocation. Between the two calls, it is possible for a
concurrent task to make an allocation with the same vaddr
and add it to the devres list.

If this happens, there will be two entries in the devres list
with the same vaddr and devres_destroy() can free the wrong
entry, triggering the WARN_ON() in dmam_match.

Fix by destroying the devres entry before freeing the DMA
allocation.

Tested:
  kokonut //net/encryption
    http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03

Fixes: 9ac7849e35 ("devres: device resource management")
Signed-off-by: Lance Richardson <rlance@google.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-08-03 08:54:36 +02:00
..
coherent.c dma-mapping: clear dev->dma_mem to NULL after freeing it 2024-01-25 15:35:26 -08:00
contiguous.c Revert "dma-contiguous: check for memory region overlap" 2023-09-08 05:58:32 -03:00
debug.c dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock 2023-08-30 11:29:08 +02:00
debug.h dma-debug: teach add_dma_entry() about DMA_ATTR_SKIP_CPU_SYNC 2021-10-18 12:46:45 +02:00
direct.c dma-direct: Leak pages on dma_set_decrypted() failure 2024-04-13 13:07:32 +02:00
direct.h dma-mapping: force bouncing if the kmalloc() size is not cache-line-aligned 2023-06-19 16:19:23 -07:00
dummy.c dma-mapping: return error code from dma_dummy_map_sg() 2021-08-09 17:13:06 +02:00
Kconfig dma-contiguous: fix the Kconfig entry for CONFIG_DMA_NUMA_CMA 2023-08-30 13:52:53 +02:00
Makefile dma-mapping: remove CONFIG_DMA_REMAP 2022-03-03 14:00:57 +03:00
map_benchmark.c dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails 2024-07-11 12:49:20 +02:00
mapping.c dma: fix call order in dmam_free_coherent 2024-08-03 08:54:36 +02:00
ops_helpers.c dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable} 2021-07-16 11:30:26 +02:00
pool.c dma-pool: remove a __maybe_unused label in atomic_pool_expand 2023-08-31 14:12:37 +02:00
remap.c dma-remap: use kvmalloc_array/kvfree for larger dma memory remap 2023-06-07 15:06:28 +02:00
swiotlb.c swiotlb: extend buffer pre-padding to alloc_align_mask if necessary 2024-06-21 14:38:46 +02:00