mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
To: barebox@lists.infradead.org
Cc: Ahmad Fatoum <a.fatoum@pengutronix.de>
Subject: [PATCH] ARM: v7r: fix TLSF memory pool mix-up
Date: Tue, 29 Apr 2025 15:50:32 +0200	[thread overview]
Message-ID: <20250429135032.3818240-1-a.fatoum@pengutronix.de> (raw)

dma_alloc_coherent allocates memory from a special memory region backing
the dma_coherent_pool. When freeing said memory, this needs to be done
with the same pool as argument, but free uses the normal pool used for
all other allocations instead. Failure to do so will trigger memory
corruption during free block merging.

This likely went unnoticed so far, because most drivers allocate
coherent memory only once in the probe path and only disable DMA.
The coherent memory is then only leaked for the short time between
barebox shutdown and Linux reclaiming all memory anyway.

This change is untested.

Fixes: 20a8958e0a67 ("ARM: add ARMv7R MPU support")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/cpu/armv7r-mpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/cpu/armv7r-mpu.c b/arch/arm/cpu/armv7r-mpu.c
index e2108ef7235e..1de9e39cc5f5 100644
--- a/arch/arm/cpu/armv7r-mpu.c
+++ b/arch/arm/cpu/armv7r-mpu.c
@@ -230,7 +230,7 @@ void *dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle
 void dma_free_coherent(struct device *dev,
 		       void *mem, dma_addr_t dma_handle, size_t size)
 {
-	free(mem);
+	tlsf_free(dma_coherent_pool, mem);
 }
 
 void arch_sync_dma_for_cpu(void *vaddr, size_t size, enum dma_data_direction dir)
-- 
2.39.5




             reply	other threads:[~2025-04-29 14:15 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-04-29 13:50 Ahmad Fatoum [this message]
2025-04-29 14:56 ` Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250429135032.3818240-1-a.fatoum@pengutronix.de \
    --to=a.fatoum@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox