linux-kernel - Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ef7cd76e-b4bf-359d-08eb-848764de75f7@wanadoo.fr>
Date:   Sat, 28 May 2022 12:06:22 +0200
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     Péter Ujfalusi <peter.ujfalusi@...il.com>,
        dan.carpenter@...cle.com, Vinod Koul <vkoul@...nel.org>,
        Joel Fernandes <joelf@...com>, Sekhar Nori <nsekhar@...com>
Cc:     linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        Peter Ujfalusi <peter.ujfalusi@...com>,
        dmaengine@...r.kernel.org
Subject: Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation
 issue in edma_setup_from_hw()

Le 28/05/2022 à 11:33, Péter Ujfalusi a écrit :
> 
> 
> On 21/05/2022 20:26, Christophe JAILLET wrote:
>> If the 'queue_priority_mapping' is not provided, we need to allocate the
>> correct amount of memory. Each entry takes 2 s8, so actually less memory
>> than needed is allocated.
>>
>> Update the size of each entry when the memory is devm_kcalloc'ed.
>>
>> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
>> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
>> ---
>> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
>> However, this looks fine to me because of the 'nelm >>= 1;' before the
>> 'for' loop.
> 
> This has been deprecated ever since we have moved to dma router to
> handle the xbar for various TI platforms, but by the looks it kida looks
> bogus in a same way.

This one is correct, IIUC.

There is an extra ">> 1" before the loop. (see [1]).

CJ

[1]: 
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/dma/ti/edma.c#n2173

> 
>> ---
>>   drivers/dma/ti/edma.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
>> index 3ea8ef7f57df..f313e2cf542c 100644
>> --- a/drivers/dma/ti/edma.c
>> +++ b/drivers/dma/ti/edma.c
>> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>>   	 * priority. So Q0 is the highest priority queue and the last queue has
>>   	 * the lowest priority.
>>   	 */
>> -	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
>> +	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
>>   					  GFP_KERNEL);
>>   	if (!queue_priority_map)
>>   		return -ENOMEM;
>