Commit dd336c55 authored by David Woodhouse's avatar David Woodhouse Committed by Greg Kroah-Hartman
Browse files

firmware_class: fix memory leak - free allocated pages 



fix memory leak introduced by the patch 6e03a201:
firmware: speed up request_firmware()

1. vfree won't release pages there were allocated explicitly and mapped
using vmap. The memory has to be vunmap-ed and the pages needs
to be freed explicitly

2. page array is moved into the 'struct
firmware' so that we can free it from release_firmware()
and not only in fw_dev_release()

The fix doesn't break the firmware load speed.

Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Singed-off-by: default avatarKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent cdc6e3d3

drivers/base/firmware_class.c

+20 −6
Original line number Diff line number Diff line
@@ -130,6 +130,17 @@ static ssize_t firmware_loading_show(struct device *dev, 
	return sprintf(buf, "%d\n", loading);

}



static void firmware_free_data(const struct firmware *fw)

{

	int i;

	vunmap(fw->data);

	if (fw->pages) {

		for (i = 0; i < PFN_UP(fw->size); i++)

			__free_page(fw->pages[i]);

		kfree(fw->pages);

	}

}



/* Some architectures don't have PAGE_KERNEL_RO */

#ifndef PAGE_KERNEL_RO

#define PAGE_KERNEL_RO PAGE_KERNEL
@@ -162,21 +173,21 @@ static ssize_t firmware_loading_store(struct device *dev, 
			mutex_unlock(&fw_lock);

			break;

		}

		vfree(fw_priv->fw->data);

		fw_priv->fw->data = NULL;

		firmware_free_data(fw_priv->fw);

		memset(fw_priv->fw, 0, sizeof(struct firmware));

		/* If the pages are not owned by 'struct firmware' */

		for (i = 0; i < fw_priv->nr_pages; i++)

			__free_page(fw_priv->pages[i]);

		kfree(fw_priv->pages);

		fw_priv->pages = NULL;

		fw_priv->page_array_size = 0;

		fw_priv->nr_pages = 0;

		fw_priv->fw->size = 0;

		set_bit(FW_STATUS_LOADING, &fw_priv->status);

		mutex_unlock(&fw_lock);

		break;

	case 0:

		if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {

			vfree(fw_priv->fw->data);

			vunmap(fw_priv->fw->data);

			fw_priv->fw->data = vmap(fw_priv->pages,

						 fw_priv->nr_pages,

						 0, PAGE_KERNEL_RO);
@@ -184,7 +195,10 @@ static ssize_t firmware_loading_store(struct device *dev, 
				dev_err(dev, "%s: vmap() failed\n", __func__);

				goto err;

			}

			/* Pages will be freed by vfree() */

			/* Pages are now owned by 'struct firmware' */

			fw_priv->fw->pages = fw_priv->pages;

			fw_priv->pages = NULL;



			fw_priv->page_array_size = 0;

			fw_priv->nr_pages = 0;

			complete(&fw_priv->completion);
@@ -578,7 +592,7 @@ release_firmware(const struct firmware *fw) 
			if (fw->data == builtin->data)

				goto free_fw;

		}

		vfree(fw->data);

		firmware_free_data(fw);

	free_fw:

		kfree(fw);

	}

include/linux/firmware.h

+1 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
struct firmware {

	size_t size;

	const u8 *data;

	struct page **pages;

};



struct device;

CRA Git | Maintained and supported by SUSTech CRA and CCSE