linux-kernel - Re: [PATCH] staging: gdm724x: Fix DMA from stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 Feb 2021 21:19:14 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     ameynarkhede03@...il.com
Cc:     gregkh@...uxfoundation.org, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: gdm724x: Fix DMA from stack

On Tue, Feb 09, 2021 at 08:24:15PM +0530, ameynarkhede03@...il.com wrote:
> From: Amey Narkhede <ameynarkhede03@...il.com>
> 
> Stack allocated buffers cannot be used for DMA
> on all architectures so allocate usbdev buffer
> using kmalloc().
> 
> Signed-off-by: Amey Narkhede <ameynarkhede03@...il.com>
> ---
>  drivers/staging/gdm724x/gdm_usb.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/gdm724x/gdm_usb.c b/drivers/staging/gdm724x/gdm_usb.c
> index dc4da66c3..50dc463d4 100644
> --- a/drivers/staging/gdm724x/gdm_usb.c
> +++ b/drivers/staging/gdm724x/gdm_usb.c
> @@ -56,7 +56,7 @@ static int gdm_usb_recv(void *priv_dev,
> 
>  static int request_mac_address(struct lte_udev *udev)
>  {
> -	u8 buf[16] = {0,};
> +	u8 *buf;
>  	struct hci_packet *hci = (struct hci_packet *)buf;
>  	struct usb_device *usbdev = udev->usbdev;
>  	int actual;
> @@ -66,6 +66,10 @@ static int request_mac_address(struct lte_udev *udev)
>  	hci->len = gdm_cpu_to_dev16(udev->gdm_ed, 1);
>  	hci->data[0] = MAC_ADDRESS;
> 
> +	buf = kmalloc(16, GFP_KERNEL);
> +	if (!buf)
> +		return -ENOMEM;
> +
>  	ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), buf, 5,
>  			   &actual, 1000);


You need to add a kfree() as well.

regards,
dan carpenter