linux-kernel - Re: [PATCH] wan: dscc4: add checks for dma mapping errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170807215943.GA22433@electric-eye.fr.zoreil.com>
Date:   Mon, 7 Aug 2017 23:59:43 +0200
From:   Francois Romieu <romieu@...zoreil.com>
To:     Alexey Khoroshilov <khoroshilov@...ras.ru>
Cc:     "David S . Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, ldv-project@...uxtesting.org
Subject: Re: [PATCH] wan: dscc4: add checks for dma mapping errors

Alexey Khoroshilov <khoroshilov@...ras.ru> :
> The driver does not check if mapping dma memory succeed.
> The patch adds the checks and failure handling.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>

Please amend your subject line as:

Subject: [PATCH net-next v2 1/1] dscc4: add checks for dma mapping errors.

Rationale: davem is not supposed to guess the branch the patch should be
applied to.

[...]
> diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
> index 799830ffcae2..1a94f0a95b2c 100644
> --- a/drivers/net/wan/dscc4.c
> +++ b/drivers/net/wan/dscc4.c
> @@ -522,19 +522,27 @@ static inline int try_get_rx_skb(struct dscc4_dev_priv *dpriv,
>  	struct RxFD *rx_fd = dpriv->rx_fd + dirty;
>  	const int len = RX_MAX(HDLC_MAX_MRU);
>  	struct sk_buff *skb;
> -	int ret = 0;
> +	dma_addr_t addr;
>  
>  	skb = dev_alloc_skb(len);
>  	dpriv->rx_skbuff[dirty] = skb;
> -	if (skb) {
> -		skb->protocol = hdlc_type_trans(skb, dev);
> -		rx_fd->data = cpu_to_le32(pci_map_single(dpriv->pci_priv->pdev,
> -					  skb->data, len, PCI_DMA_FROMDEVICE));
> -	} else {
> -		rx_fd->data = 0;
> -		ret = -1;
> -	}
> -	return ret;
> +	if (!skb)
> +		goto err_out;
> +
> +	skb->protocol = hdlc_type_trans(skb, dev);
> +	addr = pci_map_single(dpriv->pci_priv->pdev,
> +			      skb->data, len, PCI_DMA_FROMDEVICE);
> +	if (pci_dma_mapping_error(dpriv->pci_priv->pdev, addr))
> +		goto err_free_skb;

Nit: please use a local 'struct pci_dev *pdev = dpriv->pci_priv->pdev;'

[...]
> @@ -1147,14 +1155,22 @@ static netdev_tx_t dscc4_start_xmit(struct sk_buff *skb,
>  	struct dscc4_dev_priv *dpriv = dscc4_priv(dev);
>  	struct dscc4_pci_priv *ppriv = dpriv->pci_priv;
>  	struct TxFD *tx_fd;
> +	dma_addr_t addr;
>  	int next;
>  
> +	addr = pci_map_single(ppriv->pdev, skb->data, skb->len,
> +			      PCI_DMA_TODEVICE);
> +	if (pci_dma_mapping_error(ppriv->pdev, addr)) {
> +		dev_kfree_skb_any(skb);
> +		dev->stats.tx_errors++;

It should read 'dev->stats.tx_dropped++'.

-- 
Ueimor