linux-kernel - Re: [PATCH 09/16] [media] au6610: get rid of on-stack dma buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D8389B2.60507@iki.fi>
Date:	Fri, 18 Mar 2011 18:34:58 +0200
From:	Antti Palosaari <crope@....fi>
To:	Florian Mickler <florian@...kler.org>
CC:	mchehab@...radead.org, oliver@...kum.org, jwjstone@...tmail.fm,
	linux-kernel@...r.kernel.org, linux-media@...r.kernel.org
Subject: Re: [PATCH 09/16] [media] au6610: get rid of on-stack dma buffer

On 03/15/2011 10:43 AM, Florian Mickler wrote:
> usb_control_msg initiates (and waits for completion of) a dma transfer using
> the supplied buffer. That buffer thus has to be seperately allocated on
> the heap.
>
> In lib/dma_debug.c the function check_for_stack even warns about it:
> 	WARNING: at lib/dma-debug.c:866 check_for_stack
>
> Note: This change is tested to compile only, as I don't have the hardware.
>
> Signed-off-by: Florian Mickler<florian@...kler.org>


This patch did not found from patchwork! Probably skipped due to broken 
Cc at my contact. Please resend.

Anyhow, I tested and reviewed it.

Acked-by: Antti Palosaari <crope@....fi>
Reviewed-by: Antti Palosaari <crope@....fi>
Tested-by: Antti Palosaari <crope@....fi>

[1] https://patchwork.kernel.org/project/linux-media/list/

Antti



> ---
>   drivers/media/dvb/dvb-usb/au6610.c |   22 ++++++++++++++++------
>   1 files changed, 16 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/media/dvb/dvb-usb/au6610.c b/drivers/media/dvb/dvb-usb/au6610.c
> index eb34cc3..2351077 100644
> --- a/drivers/media/dvb/dvb-usb/au6610.c
> +++ b/drivers/media/dvb/dvb-usb/au6610.c
> @@ -33,8 +33,16 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
>   {
>   	int ret;
>   	u16 index;
> -	u8 usb_buf[6]; /* enough for all known requests,
> -			  read returns 5 and write 6 bytes */
> +	u8 *usb_buf;
> +
> +	/*
> +	 * allocate enough for all known requests,
> +	 * read returns 5 and write 6 bytes
> +	 */
> +	usb_buf = kmalloc(6, GFP_KERNEL);
> +	if (!usb_buf)
> +		return -ENOMEM;
> +
>   	switch (wlen) {
>   	case 1:
>   		index = wbuf[0]<<  8;
> @@ -45,14 +53,15 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
>   		break;
>   	default:
>   		warn("wlen = %x, aborting.", wlen);
> -		return -EINVAL;
> +		ret = -EINVAL;
> +		goto error;
>   	}
>
>   	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), operation,
>   			      USB_TYPE_VENDOR|USB_DIR_IN, addr<<  1, index,
> -			      usb_buf, sizeof(usb_buf), AU6610_USB_TIMEOUT);
> +			      usb_buf, 6, AU6610_USB_TIMEOUT);
>   	if (ret<  0)
> -		return ret;
> +		goto error;
>
>   	switch (operation) {
>   	case AU6610_REQ_I2C_READ:
> @@ -60,7 +69,8 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
>   		/* requested value is always 5th byte in buffer */
>   		rbuf[0] = usb_buf[4];
>   	}
> -
> +error:
> +	kfree(usb_buf);
>   	return ret;
>   }
>


-- 
http://palosaari.fi/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/