dma-mapping: benchmark: fix up kthread-related error handling

kthread creation failure is invalidly handled inside do_map_benchmark().
The put_task_struct() calls on the error path are supposed to balance the
get_task_struct() calls which only happen after all the kthreads are
successfully created. Rollback using kthread_stop() for already created
kthreads in case of such failure.

In normal situation call kthread_stop_put() to gracefully stop kthreads
and put their task refcounts. This should be done for all started
kthreads.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 65789daa8087 ("dma-mapping: add benchmark support for streaming DMA APIs")
Suggested-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

diff --git a/kernel/dma/map_benchmark.c b/kernel/dma/map_benchmark.c
index 02205ab53b7e93b2122fcfd3a4ab811fa2d97166..2478957cf9f8398a39c87c41df000169705c3f62 100644 (file)
--- a/kernel/dma/map_benchmark.c
+++ b/kernel/dma/map_benchmark.c
@@ -118,6 +118,8 @@ static int do_map_benchmark(struct map_benchmark_data *map)
                if (IS_ERR(tsk[i])) {
                        pr_err("create dma_map thread failed\n");
                        ret = PTR_ERR(tsk[i]);
+                       while (--i >= 0)
+                               kthread_stop(tsk[i]);
                        goto out;
                }
 
@@ -139,13 +141,17 @@ static int do_map_benchmark(struct map_benchmark_data *map)
 
        msleep_interruptible(map->bparam.seconds * 1000);
 
-       /* wait for the completion of benchmark threads */
+       /* wait for the completion of all started benchmark threads */
        for (i = 0; i < threads; i++) {
-               ret = kthread_stop(tsk[i]);
-               if (ret)
-                       goto out;
+               int kthread_ret = kthread_stop_put(tsk[i]);
+
+               if (kthread_ret)
+                       ret = kthread_ret;
        }
 
+       if (ret)
+               goto out;
+
        loops = atomic64_read(&map->loops);
        if (likely(loops > 0)) {
                u64 map_variance, unmap_variance;
@@ -170,8 +176,6 @@ static int do_map_benchmark(struct map_benchmark_data *map)
        }
 
 out:
-       for (i = 0; i < threads; i++)
-               put_task_struct(tsk[i]);
        put_device(map->dev);
        kfree(tsk);
        return ret;