• Mike Rapoport's avatar
    of: fix kmemleak crash caused by imbalance in early memory reservation · 5c01a25a
    Mike Rapoport authored
    Marc Gonzalez reported the following kmemleak crash:
    
      Unable to handle kernel paging request at virtual address ffffffc021e00000
      Mem abort info:
        ESR = 0x96000006
        Exception class = DABT (current EL), IL = 32 bits
        SET = 0, FnV = 0
        EA = 0, S1PTW = 0
      Data abort info:
        ISV = 0, ISS = 0x00000006
        CM = 0, WnR = 0
      swapper pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____) [ffffffc021e00000] pgd=000000017e3ba803, pud=000000017e3ba803, pmd=0000000000000000
      Internal error: Oops: 96000006 [#1] PREEMPT SMP
      Modules linked in:
      CPU: 6 PID: 523 Comm: kmemleak Tainted: G S      W         5.0.0-rc1 #13
      Hardware name: Qualcomm Technologies, Inc. MSM8998 v1 MTP (DT)
      pstate: 80000085 (Nzcv daIf -PAN -UAO)
      pc : scan_block+0x70/0x190
      lr : scan_block+0x6c/0x190
      Process kmemleak (pid: 523, stack limit = 0x(____ptrval____))
      Call trace:
       scan_block+0x70/0x190
       scan_gray_list+0x108/0x1c0
       kmemleak_scan+0x33c/0x7c0
       kmemleak_scan_thread+0x98/0xf0
       kthread+0x11c/0x120
       ret_from_fork+0x10/0x1c
      Code: f9000fb4 d503201f 97ffffd2 35000580 (f9400260)
    
    The crash happens when a no-map area is allocated in
    early_init_dt_alloc_reserved_memory_arch().  The allocated region is
    registered with kmemleak, but it is then removed from memblock using
    memblock_remove() that is not kmemleak-aware.
    
    Replacing memblock_phys_alloc_range() with memblock_find_in_range()
    makes sure that the allocated memory is not added to kmemleak and then
    memblock_remove()'ing this memory is safe.
    
    As a bonus, since memblock_find_in_range() ensures the allocation in the
    specified range, the bounds check can be removed.
    
    [rppt@linux.ibm.com: of: fix parameters order for call to memblock_find_in_range()]
      Link: http://lkml.kernel.org/r/20190221112619.GC32004@rapoport-lnx
    Link: http://lkml.kernel.org/r/20190213181921.GB15270@rapoport-lnx
    Fixes: 3f0c8206 ("drivers: of: add initialization code for dynamic reserved memory")
    Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
    Acked-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
    Acked-by: default avatarPrateek Patel <prpatel@nvidia.com>
    Tested-by: default avatarMarc Gonzalez <marc.w.gonzalez@free.fr>
    Cc: Rob Herring <robh+dt@kernel.org>
    Cc: Frank Rowand <frowand.list@gmail.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    5c01a25a
of_reserved_mem.c 9.93 KB