[PATCH] ARM: v7r: fix TLSF memory pool mix-up

[PATCH] ARM: v7r: fix TLSF memory pool mix-up

[Ahmad Fatoum]

dma_alloc_coherent allocates memory from a special memory region backing
the dma_coherent_pool. When freeing said memory, this needs to be done
with the same pool as argument, but free uses the normal pool used for
all other allocations instead. Failure to do so will trigger memory
corruption during free block merging.

This likely went unnoticed so far, because most drivers allocate
coherent memory only once in the probe path and only disable DMA.
The coherent memory is then only leaked for the short time between
barebox shutdown and Linux reclaiming all memory anyway.

This change is untested.

Fixes: 20a8958e0a67 ("ARM: add ARMv7R MPU support")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/cpu/armv7r-mpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/cpu/armv7r-mpu.c b/arch/arm/cpu/armv7r-mpu.c
index e2108ef7235e..1de9e39cc5f5 100644
--- a/arch/arm/cpu/armv7r-mpu.c
+++ b/arch/arm/cpu/armv7r-mpu.c
@@ -230,7 +230,7 @@ void *dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle
 void dma_free_coherent(struct device *dev,
 		       void *mem, dma_addr_t dma_handle, size_t size)
 {
-	free(mem);
+	tlsf_free(dma_coherent_pool, mem);
 }
 
 void arch_sync_dma_for_cpu(void *vaddr, size_t size, enum dma_data_direction dir)
-- 
2.39.5

Re: [PATCH] ARM: v7r: fix TLSF memory pool mix-up

[Sascha Hauer]

On Tue, 29 Apr 2025 15:50:32 +0200, Ahmad Fatoum wrote:
> dma_alloc_coherent allocates memory from a special memory region backing
> the dma_coherent_pool. When freeing said memory, this needs to be done
> with the same pool as argument, but free uses the normal pool used for
> all other allocations instead. Failure to do so will trigger memory
> corruption during free block merging.
> 
> This likely went unnoticed so far, because most drivers allocate
> coherent memory only once in the probe path and only disable DMA.
> The coherent memory is then only leaked for the short time between
> barebox shutdown and Linux reclaiming all memory anyway.
> 
> [...]

Applied, thanks!

[1/1] ARM: v7r: fix TLSF memory pool mix-up
      https://git.pengutronix.de/cgit/barebox/commit/?id=25889c25d600 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>