linux-kernel - Re: [PATCH v2] net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 5 Dec 2019 12:48:46 +0200
From:   Grygorii Strashko <grygorii.strashko@...com>
To:     David Miller <davem@...emloft.net>
CC:     <netdev@...r.kernel.org>, <ivan.khoronzhuk@...aro.org>,
        <nsekhar@...com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] net: ethernet: ti: davinci_cpdma: fix warning "device
 driver frees DMA memory with different size"



On 04/12/2019 22:37, David Miller wrote:
> From: Grygorii Strashko <grygorii.strashko@...com>
> Date: Wed, 4 Dec 2019 18:50:29 +0200
> 
>> @@ -1018,7 +1018,7 @@ static int cpdma_chan_submit_si(struct submit_info *si)
>>   	struct cpdma_chan		*chan = si->chan;
>>   	struct cpdma_ctlr		*ctlr = chan->ctlr;
>>   	int				len = si->len;
>> -	int				swlen = len;
>> +	int				swlen;
>>   	struct cpdma_desc __iomem	*desc;
>>   	dma_addr_t			buffer;
>>   	u32				mode;
>> @@ -1040,6 +1040,7 @@ static int cpdma_chan_submit_si(struct submit_info *si)
>>   		chan->stats.runt_transmit_buff++;
>>   	}
>>   
>> +	swlen = len;
>>   	mode = CPDMA_DESC_OWNER | CPDMA_DESC_SOP | CPDMA_DESC_EOP;
>>   	cpdma_desc_to_port(chan, mode, si->directed);
>>   
>> -- 
>> 2.17.1
>>
> 
> Now there is no reason to keep a separate swlen variable.
> 
> The integral value is always consumed as the length before the descriptor bits
> are added to it.
> 
> Therefore you can just use 'len' everywhere in this function now.
> 

Sry, but seems i can't, at least i can't just drop swlen.

Below in this function:
	writel_relaxed(0, &desc->hw_next);
	writel_relaxed(buffer, &desc->hw_buffer);
	writel_relaxed(len, &desc->hw_len);
	writel_relaxed(mode | len, &desc->hw_mode);
^^ here the "len" should be use

	writel_relaxed((uintptr_t)si->token, &desc->sw_token);
	writel_relaxed(buffer, &desc->sw_buffer);
	writel_relaxed(swlen, &desc->sw_len);
^^ and here "len"|CPDMA_DMA_EXT_MAP if (si->data_dma) [1]

	desc_read(desc, sw_len);

so additional if statement has to be added at [1] if "swlen" is dropped

-- 
Best regards,
grygorii