linux-kernel - [PATCH] media: pci/ivtv: Add missing check after DMA map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250709120834.49667-2-fourier.thomas@gmail.com>
Date: Wed,  9 Jul 2025 14:08:33 +0200
From: Thomas Fourier <fourier.thomas@...il.com>
To: 
Cc: Thomas Fourier <fourier.thomas@...il.com>,
	Andy Walls <awalls@...metrocast.net>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	Hans Verkuil <hverkuil@...all.nl>,
	Ian Armstrong <ian@...mst.demon.co.uk>,
	Chris Kennedy <c@...ovy.org>,
	John P Harvey <john.p.harvey@...nternet.com>,
	linux-media@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] media: pci/ivtv: Add missing check after DMA map

The DMA map functions can fail and should be tested for errors.
If the mapping fails, free buffers and return an error.

Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
Signed-off-by: Thomas Fourier <fourier.thomas@...il.com>
---
 drivers/media/pci/ivtv/ivtv-queue.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/media/pci/ivtv/ivtv-queue.c b/drivers/media/pci/ivtv/ivtv-queue.c
index f9b192ab7e7c..c8a5f6d37bd4 100644
--- a/drivers/media/pci/ivtv/ivtv-queue.c
+++ b/drivers/media/pci/ivtv/ivtv-queue.c
@@ -221,6 +221,16 @@ int ivtv_stream_alloc(struct ivtv_stream *s)
 		s->sg_handle = dma_map_single(&itv->pdev->dev, s->sg_dma,
 					      sizeof(struct ivtv_sg_element),
 					      DMA_TO_DEVICE);
+		if (dma_mapping_error(&itv->pdev->dev, s->sg_handle)) {
+			IVTV_ERR("Could not dma map sg_dma for %s stream\n", s->name);
+			kfree(s->sg_pending);
+			s->sg_pending = NULL;
+			kfree(s->sg_processing);
+			s->sg_processing = NULL;
+			kfree(s->sg_dma);
+			s->sg_dma = NULL;
+			return -ENOMEM;
+		}
 		ivtv_stream_sync_for_cpu(s);
 	}
 
@@ -240,6 +250,12 @@ int ivtv_stream_alloc(struct ivtv_stream *s)
 		if (ivtv_might_use_dma(s)) {
 			buf->dma_handle = dma_map_single(&s->itv->pdev->dev,
 				buf->buf, s->buf_size + 256, s->dma);
+			if (dma_mapping_error(&s->itv->pdev->dev,
+					      buf->dma_handle)) {
+				kfree(buf->buf);
+				kfree(buf);
+				break;
+			}
 			ivtv_buf_sync_for_cpu(s, buf);
 		}
 		ivtv_enqueue(s, buf, &s->q_free);
-- 
2.43.0