linux-kernel - [PATCH] drivers/base: wrong return value of dmam_declare_coherent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 28 Apr 2016 13:28:23 +0200
From:	Vyacheslav Yurkov <uvv.mail@...il.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] drivers/base: wrong return value of dmam_declare_coherent_memory

Hi guys,
I found an issue in managed version of dma_declare_coherent_memory,
i.e. in dmam_declare_coherent_memory. It looks like the return value
of dma_declare_coherent_memory is zero in case of error and a
requested flag on success, which dmam_* version doesn't take into
account and this leads to leaking of resources.

---
Yours sincerely,
Vyacheslav V. Yurkov

P.S.: I'm not subscribed to the maillist, so please include me in CC
when responding to this Email.

---
--- linux-4.5.2/drivers/base/dma-mapping.c.orig	2016-04-20
08:46:35.000000000 +0200
+++ linux-4.5.2/drivers/base/dma-mapping.c	2016-04-28 10:15:34.295080491
+0200
@@ -198,10 +198,15 @@ int dmam_declare_coherent_memory(struct

 	rc = dma_declare_coherent_memory(dev, phys_addr, device_addr, size,
 					 flags);
-	if (rc == 0)
+
+	if ((flags & DMA_MEMORY_MAP) == DMA_MEMORY_MAP ||
+	    (flags & DMA_MEMORY_IO) == DMA_MEMORY_IO) {
 		devres_add(dev, res);
-	else
+		rc = 0;
+	} else {
 		devres_free(res);
+		rc = -ENOMEM;
+	}

 	return rc;
 }

Signed-off-by: Vyacheslav Yurkov <uvv.mail@...il.com>