[PATCH] tee: optee: Set a flag to avoid memory leaks

When an rpc message to release memory is not received, a memory leak will occur, which should be released

unreferenced object 0xffff00006871b580 (size 128):

comm "swapper/0", pid 1, jiffies 4294892673 (age 428.192s)

hex dump (first 32 bytes):

80 b3 71 68 00 00 ff ff 00 e0 71 a8 00 00 00 00 ..qh......q.....

00 e0 71 68 00 00 ff ff 00 10 00 00 00 00 00 00 ..qh............

backtrace:

[<00000000f0425299>] slab_post_alloc_hook+0x6c/0x338

[<000000004705f905>] kmem_cache_alloc+0x1d4/0x328

[<00000000773c66a0>] tee_shm_alloc+0x84/0x268

[<00000000ca052f98>] optee_handle_rpc+0x144/0x5a0

[<0000000015a8eebe>] optee_do_call_with_arg+0x14c/0x168

[<00000000d51ef0fd>] optee_open_session+0x12c/0x200

[<000000007146f51d>] tee_client_open_session+0x24/0x38

[<00000000ea2b35e7>] optee_enumerate_devices+0xa0/0x2c0

[<0000000068088775>] optee_probe+0x560/0x690

[<00000000ad1d997a>] platform_drv_probe+0x54/0xa8

[<00000000e11592d4>] really_probe+0x118/0x3e0

[<00000000dacd3142>] driver_probe_device+0x5c/0xc0

[<0000000077c13842>] device_driver_attach+0x74/0x80

[<00000000106ccc62>] __driver_attach+0x8c/0xd8

[<00000000e120c345>] bus_for_each_dev+0x7c/0xd8

[<00000000b79335f5>] driver_attach+0x24/0x30

Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.commailto:xiaolei.wang@windriver.com>

---

drivers/tee/optee/call.c | 7 ++++++-

drivers/tee/optee/optee_private.h | 2 +-

drivers/tee/optee/rpc.c | 4 +++-

3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c index 20b6fd7383c5..522c133b9d95 100644

--- a/drivers/tee/optee/call.c

+++ b/drivers/tee/optee/call.c

@@ -129,6 +129,7 @@ u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg)

struct optee_rpc_param param = { };

struct optee_call_ctx call_ctx = { };

u32 ret;

+ unsigned int flags = 0;

param.a0 = OPTEE_SMC_CALL_WITH_ARG;

reg_pair_from_64(&param.a1, &param.a2, parg); @@ -153,9 +154,13 @@ u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg)

param.a1 = res.a1;

param.a2 = res.a2;

param.a3 = res.a3;

- optee_handle_rpc(ctx, &param, &call_ctx);

+ optee_handle_rpc(ctx, &param, &call_ctx, &flags);

} else {

ret = res.a0;

+ if (flags != 0x0) {

+ param.a0 = 2;

+ optee_handle_rpc(ctx, &param, &call_ctx, &flags);

+ }

break;

}

}

diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h

index 8b71839a357e..1c1d62e21141 100644

--- a/drivers/tee/optee/optee_private.h

+++ b/drivers/tee/optee/optee_private.h

@@ -127,7 +127,7 @@ struct optee_call_ctx { };

void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,

- struct optee_call_ctx *call_ctx);

+ struct optee_call_ctx *call_ctx, unsigned int *flags);

void optee_rpc_finalize_call(struct optee_call_ctx *call_ctx);

void optee_wait_queue_init(struct optee_wait_queue *wq); diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c index b4ade54d1f28..4e76c87b61f4 100644

--- a/drivers/tee/optee/rpc.c

+++ b/drivers/tee/optee/rpc.c

@@ -396,7 +396,7 @@ static void handle_rpc_func_cmd(struct tee_context *ctx, struct optee *optee,

* Result of RPC is written back into @param.

*/

void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,

- struct optee_call_ctx *call_ctx)

+ struct optee_call_ctx *call_ctx, unsigned int *flags)

{

struct tee_device *teedev = ctx->teedev;

struct optee *optee = tee_get_drvdata(teedev); @@ -410,6 +410,7 @@ void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,

reg_pair_from_64(&param->a1, &param->a2, pa);

reg_pair_from_64(&param->a4, &param->a5,

(unsigned long)shm);

+ *flags = 0x1;

} else {

param->a1 = 0;

param->a2 = 0;

@@ -420,6 +421,7 @@ void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,

case OPTEE_SMC_RPC_FUNC_FREE:

shm = reg_pair_to_ptr(param->a1, param->a2);

tee_shm_free(shm);

+ *flags = 0x0;

break;

case OPTEE_SMC_RPC_FUNC_FOREIGN_INTR:

/*

--

2.25.1