linux/mm/dmapool.c, branch v4.3

dmapool: fix overflow condition in pool_find_page()

2015-10-02T01:42:35Z

If a DMA pool lies at the very top of the dma_addr_t range (as may happen with an IOMMU involved), the calculated end address of the pool wraps around to zero, and page lookup always fails. Tweak the relevant calculation to be overflow-proof. Signed-off-by: Robin Murphy Cc: Arnd Bergmann Cc: Marek Szyprowski Cc: Sumit Semwal Cc: Sakari Ailus Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm: add support for __GFP_ZERO flag to dma_pool_alloc()

2015-09-08T22:35:28Z

Currently a call to dma_pool_alloc() with a ___GFP_ZERO flag returns a non-zeroed memory region. This patchset adds support for the __GFP_ZERO flag to dma_pool_alloc(), adds 2 wrapper functions for allocing zeroed memory from a pool, and provides a coccinelle script for finding & replacing instances of dma_pool_alloc() followed by memset(0) with a single dma_pool_zalloc() call. There was some concern that this always calls memset() to zero, instead of passing __GFP_ZERO into the page allocator. [https://lkml.org/lkml/2015/7/15/881] I ran a test on my system to get an idea of how often dma_pool_alloc() calls into pool_alloc_page(). After Boot: [ 30.119863] alloc_calls:541, page_allocs:7 After an hour: [ 3600.951031] alloc_calls:9566, page_allocs:12 After copying 1GB file onto a USB drive: [ 4260.657148] alloc_calls:17225, page_allocs:12 It doesn't look like dma_pool_alloc() calls down to the page allocator very often (at least on my system). This patch (of 4): Currently the __GFP_ZERO flag is ignored by dma_pool_alloc(). Make dma_pool_alloc() zero the memory if this flag is set. Signed-off-by: Sean O. Stalley Acked-by: David Rientjes Cc: Vinod Koul Cc: Bjorn Helgaas Cc: Gilles Muller Cc: Nicolas Palix Cc: Michal Marek Cc: Sebastian Andrzej Siewior Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm/dmapool: allow NULL `pool' pointer in dma_pool_destroy()

2015-09-08T22:35:28Z

dma_pool_destroy() does not tolerate a NULL dma_pool pointer argument and performs a NULL-pointer dereference. This requires additional attention and effort from developers/reviewers and forces all dma_pool_destroy() callers to do a NULL check if (pool) dma_pool_destroy(pool); Or, otherwise, be invalid dma_pool_destroy() users. Tweak dma_pool_destroy() and NULL-check the pointer there. Proposed by Andrew Morton. Link: https://lkml.org/lkml/2015/6/8/583 Signed-off-by: Sergey Senozhatsky Acked-by: David Rientjes Cc: Julia Lawall Cc: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm/dmapool.c: change is_page_busy() return from int to bool

2015-09-04T23:54:41Z

This makes the function is_page_busy() return bool rather then an int now due to this particular function's single return statement only ever evaulating to either one or zero. Signed-off-by: Nicholas Krause Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm/dmapool.c: fixed a brace coding style issue

2014-10-10T02:26:00Z

Remove 3 brace coding style for any arm of this statement Signed-off-by: Paul McQuade Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm: dmapool: add/remove sysfs file outside of the pool lock lock

2014-10-10T02:25:59Z

cat /sys/.../pools followed by removal the device leads to: |====================================================== |[ INFO: possible circular locking dependency detected ] |3.17.0-rc4+ #1498 Not tainted |------------------------------------------------------- |rmmod/2505 is trying to acquire lock: | (s_active#28){++++.+}, at: [] kernfs_remove_by_name_ns+0x3c/0x88 | |but task is already holding lock: | (pools_lock){+.+.+.}, at: [] dma_pool_destroy+0x18/0x17c | |which lock already depends on the new lock. |the existing dependency chain (in reverse order) is: | |-> #1 (pools_lock){+.+.+.}: | [] show_pools+0x30/0xf8 | [] dev_attr_show+0x1c/0x48 | [] sysfs_kf_seq_show+0x88/0x10c | [] kernfs_seq_show+0x24/0x28 | [] seq_read+0x1b8/0x480 | [] vfs_read+0x8c/0x148 | [] SyS_read+0x40/0x8c | [] ret_fast_syscall+0x0/0x48 | |-> #0 (s_active#28){++++.+}: | [] __kernfs_remove+0x258/0x2ec | [] kernfs_remove_by_name_ns+0x3c/0x88 | [] dma_pool_destroy+0x148/0x17c | [] hcd_buffer_destroy+0x20/0x34 | [] usb_remove_hcd+0x110/0x1a4 The problem is the lock order of pools_lock and kernfs_mutex in dma_pool_destroy() vs show_pools() call path. This patch breaks out the creation of the sysfs file outside of the pools_lock mutex. The newly added pools_reg_lock ensures that there is no race of create vs destroy code path in terms whether or not the sysfs file has to be deleted (and was it deleted before we try to create a new one) and what to do if device_create_file() failed. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Fix unbalanced mutex in dma_pool_create().

2014-09-18T17:39:16Z

dma_pool_create() needs to unlock the mutex in error case. The bug was introduced in the 3.16 by commit cc6b664aa26d ("mm/dmapool.c: remove redundant NULL check for dev in dma_pool_create()")/ Signed-off-by: Krzysztof Hałasa Cc: stable@vger.kernel.org # v3.16 Signed-off-by: Linus Torvalds

mm/dmapool.c: reuse devres_release() to free resources

2014-06-04T23:54:08Z

Instead of calling an additional routine in dmam_pool_destroy() rely on what dmam_pool_release() is doing. Signed-off-by: Andy Shevchenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm/dmapool.c: remove redundant NULL check for dev in dma_pool_create()

2014-06-04T23:54:04Z

"dev" cannot be NULL because it is already checked before calling dma_pool_create(). If dev ever was NULL, the code would oops in dev_to_node() after enabling CONFIG_NUMA. It is possible that some driver is using dev==NULL and has never been run on a NUMA machine. Such a driver is probably outdated, possibly buggy and will need some attention if it starts triggering NULL derefs. Signed-off-by: Daeseok Youn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mm: Fix printk typo in dmapool.c

2014-05-05T13:44:47Z

Fix printk typo in dmapool.c Signed-off-by: Hiroshige Sato Signed-off-by: Jiri Kosina