• Lance Richardson's avatar
    dma: fix call order in dmam_free_coherent · 28e8b740
    Lance Richardson authored
    dmam_free_coherent() frees a DMA allocation, which makes the
    freed vaddr available for reuse, then calls devres_destroy()
    to remove and free the data structure used to track the DMA
    allocation. Between the two calls, it is possible for a
    concurrent task to make an allocation with the same vaddr
    and add it to the devres list.
    
    If this happens, there will be two entries in the devres list
    with the same vaddr and devres_destroy() can free the wrong
    entry, triggering the WARN_ON() in dmam_match.
    
    Fix by destroying the devres entry before freeing the DMA
    allocation.
    
    Tested:
      kokonut //net/encryption
        http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03
    
    Fixes: 9ac7849e ("devres: device resource management")
    Signed-off-by: default avatarLance Richardson <rlance@google.com>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    28e8b740
mapping.c 26.1 KB