linux-kernel - [PATCH] serial: msm: check dma_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 19 Apr 2024 10:09:31 +0200
From: "Jiri Slaby (SUSE)" <jirislaby@...nel.org>
To: gregkh@...uxfoundation.org
Cc: linux-serial@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	"Jiri Slaby (SUSE)" <jirislaby@...nel.org>,
	Marek Szyprowski <m.szyprowski@...sung.com>
Subject: [PATCH] serial: msm: check dma_map_sg() return value properly

The -next commit f8fef2fa419f (tty: msm_serial: use
dmaengine_prep_slave_sg()), switched to using dma_map_sg(). But the
return value of dma_map_sg() is special: it returns number of elements
mapped. And not a standard error value.

The commit also forgot to reset dma->tx_sg in case of this failure.

Fix both these mistakes.

Thanks to Marek who helped debugging this.

Signed-off-by: Jiri Slaby (SUSE) <jirislaby@...nel.org>
Reported-by: Marek Szyprowski <m.szyprowski@...sung.com>
---
 drivers/tty/serial/msm_serial.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index ae7a8e3cf467..0a9c5219df88 100644
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -499,15 +499,18 @@ static int msm_handle_tx_dma(struct msm_port *msm_port, unsigned int count)
 	struct uart_port *port = &msm_port->uart;
 	struct tty_port *tport = &port->state->port;
 	struct msm_dma *dma = &msm_port->tx_dma;
+	unsigned int mapped;
 	int ret;
 	u32 val;
 
 	sg_init_table(&dma->tx_sg, 1);
 	kfifo_dma_out_prepare(&tport->xmit_fifo, &dma->tx_sg, 1, count);
 
-	ret = dma_map_sg(port->dev, &dma->tx_sg, 1, dma->dir);
-	if (ret)
-		return ret;
+	mapped = dma_map_sg(port->dev, &dma->tx_sg, 1, dma->dir);
+	if (!mapped) {
+		ret = -EIO;
+		goto zero_sg;
+	}
 
 	dma->desc = dmaengine_prep_slave_sg(dma->chan, &dma->tx_sg, 1,
 						DMA_MEM_TO_DEV,
@@ -548,6 +551,7 @@ static int msm_handle_tx_dma(struct msm_port *msm_port, unsigned int count)
 	return 0;
 unmap:
 	dma_unmap_sg(port->dev, &dma->tx_sg, 1, dma->dir);
+zero_sg:
 	sg_init_table(&dma->tx_sg, 1);
 	return ret;
 }
-- 
2.44.0