linux-kernel - [PATCH 1/2] net: ll_temac: fix DMA resources leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230126101607.88407-1-jsc@umbraculum.org>
Date:   Thu, 26 Jan 2023 11:16:06 +0100
From:   Jonas Suhr Christensen <jsc@...raculum.org>
To:     netdev@...r.kernel.org
Cc:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com, michal.simek@...inx.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        esben@...nix.com, Jonas Suhr Christensen <jsc@...raculum.org>
Subject: [PATCH 1/2] net: ll_temac: fix DMA resources leak

Add missing conversion of address when unmapping dma region causing
unmapping to silently fail. At some point resulting in buffer
overrun eg. when releasing device.

Signed-off-by: Jonas Suhr Christensen <jsc@...raculum.org>
---
 drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1066420d6a83..66c04027f230 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -300,6 +300,7 @@ static void temac_dma_bd_release(struct net_device *ndev)
 {
 	struct temac_local *lp = netdev_priv(ndev);
 	int i;
+	struct cdmac_bd *bd;
 
 	/* Reset Local Link (DMA) */
 	lp->dma_out(lp, DMA_CONTROL_REG, DMA_CONTROL_RST);
@@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev)
 	for (i = 0; i < lp->rx_bd_num; i++) {
 		if (!lp->rx_skb[i])
 			break;
-		dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys,
+
+		bd = &lp->rx_bd_v[1];
+		dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys),
 				 XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE);
+		bd->phys = 0;
+		bd->len = 0;
 		dev_kfree_skb(lp->rx_skb[i]);
+		lp->rx_skb[i] = NULL;
 	}
 	if (lp->rx_bd_v)
 		dma_free_coherent(ndev->dev.parent,
-- 
2.39.1