netdev - Re: [PATCH 2/2] benet: fix the misusage of zero dma address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 5 Apr 2010 12:40:59 +0530
From:	Sathya Perla <sathyap@...verengines.com>
To:	FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
Cc:	sathyap@...verengines.com, subbus@...verengines.com,
	sarveshwarb@...verengines.com, ajitk@...verengines.com,
	netdev@...r.kernel.org
Subject: Re: [PATCH 2/2] benet: fix the misusage of zero dma address

Hi Fujita, thanks for the patch; pls see below:

On 02/04/10 11:53 +0900, FUJITA Tomonori wrote:
> benet driver wrongly assumes that zero is an invalid dma address
> (calls dma_unmap_page for only non zero dma addresses). Zero is a
> valid dma address on some architectures. The dma length can be used
> here.
> 
> Signed-off-by: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
> ---
>  drivers/net/benet/be_main.c |    6 ++++--
>  1 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
> index 8d5e27b..8828c7d 100644
> --- a/drivers/net/benet/be_main.c
> +++ b/drivers/net/benet/be_main.c
> @@ -394,13 +394,15 @@ static void unmap_tx_frag(struct pci_dev *pdev, struct be_eth_wrb *wrb,
>  	be_dws_le_to_cpu(wrb, sizeof(*wrb));
>  
>  	dma = (u64)wrb->frag_pa_hi << 32 | (u64)wrb->frag_pa_lo;
> -	if (dma != 0) {
> +	if (wrb->frag_len) {
>  		if (unmap_single)
>  			pci_unmap_single(pdev, dma, wrb->frag_len,
>  				PCI_DMA_TODEVICE);
>  		else
>  			pci_unmap_page(pdev, dma, wrb->frag_len,
>  				PCI_DMA_TODEVICE);
> +
> +		wrb->frag_len = 0;
Why does wrb->frag_len need to be reset here?
In the TX path, it is set to the proper value for data wrbs and zero
for dummy and hdr wrbs.
>  	}
>  }
>  
> @@ -466,9 +468,9 @@ dma_err:
>  	txq->head = map_head;
>  	while (copied) {
>  		wrb = queue_head_node(txq);
> +		copied -= wrb->frag_len;
>  		unmap_tx_frag(pdev, wrb, map_single);
>  		map_single = false;
> -		copied -= wrb->frag_len;
>  		queue_head_inc(txq);
>  	}
>  	return 0;
> -- 
> 1.7.0
> 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html