linux-kernel - Re: [PATCH] drivers/base: wrong return value of dmam_declare_coherent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160428163128.2670db58033e598779e373f6@e-mail.ua>
Date:	Thu, 28 Apr 2016 16:31:28 +0200
From:	Andrey Gursky <andrey.gursky@...ail.ua>
To:	Vyacheslav Yurkov <uvv.mail@...il.com>
Cc:	linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] drivers/base: wrong return value of
 dmam_declare_coherent_memory

Vyacheslav,

thanks for your patch.

For now it introduces a new bug.

Vyacheslav Yurkov <uvv.mail <at> gmail.com> writes:

> 
> Hi guys,
> I found an issue in managed version of dma_declare_coherent_memory,
> i.e. in dmam_declare_coherent_memory. It looks like the return value
> of dma_declare_coherent_memory is zero in case of error and a
> requested flag on success,

You should take this into account and not ignore the value of rc at all
by using flags instead, which is not being altered by
dma_declare_coherent_memory() making the latter appear to succeed
always.

> which dmam_* version doesn't take into
> account and this leads to leaking of resources.
> 
> ---
> Yours sincerely,
> Vyacheslav V. Yurkov
> 
> P.S.: I'm not subscribed to the maillist, so please include me in CC
> when responding to this Email.
> 
> ---
> --- linux-4.5.2/drivers/base/dma-mapping.c.orig	2016-04-20
> 08:46:35.000000000 +0200
> +++ linux-4.5.2/drivers/base/dma-mapping.c	2016-04-28 10:15:34.295080491
> +0200
>  <at>  <at>  -198,10 +198,15  <at>  <at>  int dmam_declare_coherent_memory(struct
> 
>  	rc = dma_declare_coherent_memory(dev, phys_addr, device_addr, size,
>  					 flags);
> -	if (rc == 0)
> +
> +	if ((flags & DMA_MEMORY_MAP) == DMA_MEMORY_MAP ||
> +	    (flags & DMA_MEMORY_IO) == DMA_MEMORY_IO) {
>  		devres_add(dev, res);
> -	else
> +		rc = 0;
> +	} else {
>  		devres_free(res);
> +		rc = -ENOMEM;
> +	}
> 
>  	return rc;
>  }
> 
> Signed-off-by: Vyacheslav Yurkov <uvv.mail <at> gmail.com>
> 

Best Regards,
Andrey