From b11b9665552041db83e0d284c27e51aeb98759be Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" Date: Wed, 18 Sep 2019 10:11:51 -0700 Subject: [PATCH 1/2] ion: msm: Prevent log-spam from ION dmabuf mmap failures Use rate-limited prints when an ION buffer should not be mapped to userspace. This prevents the kernel logs from being flooded by failures triggered by continuous userspace requests to map a buffer that should not be mapped to it. Change-Id: I5f4a1bc1fab7424588e68a55cb18aa28e969841c Signed-off-by: Isaac J. Manjarres --- drivers/staging/android/ion/heaps/msm_ion_dma_buf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/android/ion/heaps/msm_ion_dma_buf.c b/drivers/staging/android/ion/heaps/msm_ion_dma_buf.c index ba89e56236e2..86e7226a2abd 100644 --- a/drivers/staging/android/ion/heaps/msm_ion_dma_buf.c +++ b/drivers/staging/android/ion/heaps/msm_ion_dma_buf.c @@ -283,8 +283,8 @@ static int msm_ion_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) int ret = 0; if (!hlos_accessible_buffer(buffer)) { - pr_err("%s: this buffer cannot be mapped to userspace\n", - __func__); + pr_err_ratelimited("%s: this buffer cannot be mapped to userspace\n", + __func__); return -EINVAL; } From 38a894b4630a5be7467519c036e40e2e3458db80 Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" Date: Wed, 18 Sep 2019 13:22:14 -0700 Subject: [PATCH 2/2] ion: msm: Correct memory-region of_node reference counting of_parse_phandle() is used to deduce if a memory region is associated with a particular device. The call to of_parse_phandle() internally increments the reference count to the memory region's of_node, and thus, the caller should reverse that action by decrementing it via a call to of_node_put(). Change-Id: I80a0ed843312229f277c09fe107e407118a0a473 Signed-off-by: Isaac J. Manjarres --- .../staging/android/ion/heaps/ion_carveout_heap.c | 15 +++++++++------ drivers/staging/android/ion/heaps/msm_ion_of.c | 3 ++- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/staging/android/ion/heaps/ion_carveout_heap.c b/drivers/staging/android/ion/heaps/ion_carveout_heap.c index 8e4aedcc0a09..1b77ae563dbf 100644 --- a/drivers/staging/android/ion/heaps/ion_carveout_heap.c +++ b/drivers/staging/android/ion/heaps/ion_carveout_heap.c @@ -327,12 +327,13 @@ static int ion_sc_add_child(struct ion_sc_heap *manager, basep = of_get_address(phandle, 0, &size, NULL); if (!basep) - goto out_free; + goto out_put_phandle; base = of_translate_address(phandle, basep); if (base == OF_BAD_ADDR) - goto out_free; + goto out_put_phandle; + of_node_put(phandle); heap_data.priv = dev; heap_data.base = base; heap_data.size = size; @@ -343,16 +344,18 @@ static int ion_sc_add_child(struct ion_sc_heap *manager, goto out_free; ret = ion_sc_get_dt_token(entry, np, base, size); - if (ret) - goto out_free_carveout; + if (ret) { + ion_carveout_heap_destroy(entry->heap); + goto out_free; + } list_add(&entry->list, &manager->children); dev_info(dev, "ion_secure_carveout: creating heap@0x%llx, size 0x%llx\n", base, size); return 0; -out_free_carveout: - ion_carveout_heap_destroy(entry->heap); +out_put_phandle: + of_node_put(phandle); out_free: kfree(entry); return -EINVAL; diff --git a/drivers/staging/android/ion/heaps/msm_ion_of.c b/drivers/staging/android/ion/heaps/msm_ion_of.c index bdeea44e0995..a2542aa413d1 100644 --- a/drivers/staging/android/ion/heaps/msm_ion_of.c +++ b/drivers/staging/android/ion/heaps/msm_ion_of.c @@ -276,6 +276,7 @@ static void release_reserved_memory_regions(struct ion_platform_heap *heaps, if (mem_node) release_reserved_memory(dev, mem_node); + of_node_put(mem_node); } } @@ -317,12 +318,12 @@ static int msm_ion_get_heap_dt_data(struct device_node *node, heap->base = base; heap->size = size; } - of_node_put(pnode); } else { ret = 0; } out: + of_node_put(pnode); WARN(ret, "Failed to parse DT node for heap %s\n", heap->name); return ret; }