• Gustav Wiklander's avatar
    spi: Fix memory leak on splited transfers · b59a7ca1
    Gustav Wiklander authored
    In the prepare_message callback the bus driver has the
    opportunity to split a transfer into smaller chunks.
    spi_map_msg is done after prepare_message.
    
    Function spi_res_release releases the splited transfers
    in the message. Therefore spi_res_release should be called
    after spi_map_msg.
    
    The previous try at this was commit c9ba7a16
    which released the splited transfers after
    spi_finalize_current_message had been called.
    This introduced a race since the message struct could be
    out of scope because the spi_sync call got completed.
    
    Fixes this leak on spi bus driver spi-bcm2835.c when transfer
    size is greater than 65532:
    
    Kmemleak:
    sg_alloc_table+0x28/0xc8
    spi_map_buf+0xa4/0x300
    __spi_pump_messages+0x370/0x748
    __spi_sync+0x1d4/0x270
    spi_sync+0x34/0x58
    spi_test_execute_msg+0x60/0x340 [spi_loopback_test]
    spi_test_run_iter+0x548/0x578 [spi_loopback_test]
    spi_test_run_test+0x94/0x140 [spi_loopback_test]
    spi_test_run_tests+0x150/0x180 [spi_loopback_test]
    spi_loopback_test_probe+0x50/0xd0 [spi_loopback_test]
    spi_drv_probe+0x84/0xe0
    Signed-off-by: default avatarGustav Wiklander <gustavwi@axis.com>
    Link: https://lore.kernel.org/r/20200908151129.15915-1-gustav.wiklander@axis.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
    b59a7ca1
spi.c 112 KB