linux-kernel - Re: [PATCH wireless-next] wifi: ath12k: allocate dummy net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 4 May 2024 15:55:23 +0100
From: Simon Horman <horms@...nel.org>
To: Breno Leitao <leitao@...ian.org>
Cc: Kalle Valo <kvalo@...nel.org>, Jeff Johnson <jjohnson@...nel.org>,
	netdev@...r.kernel.org, linux-wireless@...r.kernel.org,
	ath12k@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH wireless-next] wifi: ath12k: allocate dummy net_device
 dynamically

On Fri, May 03, 2024 at 03:04:39AM -0700, Breno Leitao wrote:
> Embedding net_device into structures prohibits the usage of flexible
> arrays in the net_device structure. For more details, see the discussion
> at [1].
> 
> Un-embed the net_device from struct ath12k_ext_irq_grp by converting it
> into a pointer. Then use the leverage alloc_netdev_dummy() to allocate
> the net_device object at ath12k_pci_ext_irq_config().
> 
> The free of the device occurs at ath12k_pci_free_ext_irq().
> 
> [1] https://lore.kernel.org/all/20240229225910.79e224cf@kernel.org/
> 
> This is *very* similar to the same changes in ath11k commit
> bca592ead82528b ("wifi: ath11k: allocate dummy net_device dynamically")
> 
> Signed-off-by: Breno Leitao <leitao@...ian.org>

..

> diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c

..

> @@ -577,8 +578,11 @@ static int ath12k_pci_ext_irq_config(struct ath12k_base *ab)
>  
>  		irq_grp->ab = ab;
>  		irq_grp->grp_id = i;
> -		init_dummy_netdev(&irq_grp->napi_ndev);
> -		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
> +		irq_grp->napi_ndev = alloc_netdev_dummy(0);
> +		if (!irq_grp->napi_ndev)
> +			return -ENOMEM;

Hi Breno,

Will returning on error here leak resources allocated by
alloc_netdev_dummy() in previous iterations of this loop?

If so, I suggest jumping to unwind handling which
can be shared with the error path in the hunk below.

> +
> +		netif_napi_add(irq_grp->napi_ndev, &irq_grp->napi,
>  			       ath12k_pci_ext_grp_napi_poll);
>  
>  		if (ab->hw_params->ring_mask->tx[i] ||
> @@ -611,6 +615,10 @@ static int ath12k_pci_ext_irq_config(struct ath12k_base *ab)
>  			if (ret) {
>  				ath12k_err(ab, "failed request irq %d: %d\n",
>  					   vector, ret);
> +				for (n = 0; n <= i; n++) {
> +					irq_grp = &ab->ext_irq_grp[n];
> +					free_netdev(irq_grp->napi_ndev);
> +				}
>  				return ret;
>  			}
>  		}

-- 
pw-client: under-review