linux-kernel - Re: [PATCH v3] staging: gdm724x: Fix DMA from stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Feb 2021 18:19:24 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Amey Narkhede <ameynarkhede03@...il.com>
Cc:     Greg KH <gregkh@...uxfoundation.org>, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] staging: gdm724x: Fix DMA from stack

On Wed, Feb 10, 2021 at 08:31:33PM +0530, Amey Narkhede wrote:
> On 21/02/10 03:55PM, Greg KH wrote:
> > On Wed, Feb 10, 2021 at 07:55:12PM +0530, Amey Narkhede wrote:
> > > Stack allocated buffers cannot be used for DMA
> > > on all architectures so allocate hci_packet buffer
> > > using kmalloc.
> > >
> > > Signed-off-by: Amey Narkhede <ameynarkhede03@...il.com>
> > > ---
> > > Changes in v3:
> > > 	- Remove superfluous buf pointer
> > > 	- Reduce size of allocation of hci_packet to match number of
> > > 	bytes used for DMA
> > >
> > >  drivers/staging/gdm724x/gdm_usb.c | 10 +++++++---
> > >  1 file changed, 7 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/staging/gdm724x/gdm_usb.c b/drivers/staging/gdm724x/gdm_usb.c
> > > index dc4da66c3..80c58a3ef 100644
> > > --- a/drivers/staging/gdm724x/gdm_usb.c
> > > +++ b/drivers/staging/gdm724x/gdm_usb.c
> > > @@ -56,20 +56,24 @@ static int gdm_usb_recv(void *priv_dev,
> > >
> > >  static int request_mac_address(struct lte_udev *udev)
> > >  {
> > > -	u8 buf[16] = {0,};
> > > -	struct hci_packet *hci = (struct hci_packet *)buf;
> > > +	struct hci_packet *hci;
> > >  	struct usb_device *usbdev = udev->usbdev;
> > >  	int actual;
> > >  	int ret = -1;
> > >
> > > +	hci = kmalloc(5, GFP_KERNEL);
> >
> > Why "5" and not:
> > 	hci = kmalloc(sizeof(*hci), GFP_KERNEL);

5 is correct and sizeof(*hci) is 4.  The hci struct ends in a zero
element array.  You could do:

	hci = kmalloc(struct_size(hci, data, 1), GFP_KERNEL);

I'm not sure it's more readable.  But you still will have to resend
because the patch passes "&hci" to usb_bulk_msg() instead of "hci" so it
will corrupt memory.

I always encourage people to write the patch and then sit on it over
night and send it the next day.

regards,
dan carpenter