netdev - DM9000 issue with mem resource management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200806051743.00614.laurentp@cse-semaphore.com>
Date:	Thu, 5 Jun 2008 17:42:58 +0200
From:	Laurent Pinchart <laurentp@...-semaphore.com>
To:	netdev@...r.kernel.org
Cc:	Ben Dooks <ben-linux@...ff.org>
Subject: DM9000 issue with mem resource management

Hi everybody,

I ran into a resource-related bug in the DM9000 driver.

When the platform device has only 2 resources, dm9000_probe() doesn't set 
db->irq_res, which results in a segfault when the pointer gets dereferenced 
in dm9000_open().

I tried to fix the issue, and found out that the resource management code is 
quite broken.

If I understand things correctly, specifying 3 resources makes the DM9000 
driver ioremap() the memory, while specifying 2 resources implies that the 
platform code already ioremap()ed the memory. Is that right ?

If so, why does dm9000_probe() call request_mem_region() on ioremap()ed 
memory ?

Wouldn't it also be simpler to use release_mem_region() in 
dm9000_release_board() instead of release_resource() + kfree() ?

I'd be grateful if someone could confirm my assumptions. I'll then submit a 
patch to fix those issues.

Best regards,

-- 
Laurent Pinchart
CSE Semaphore Belgium

Chaussee de Bruxelles, 732A
B-1410 Waterloo
Belgium

T +32 (2) 387 42 59
F +32 (2) 387 42 75

Content of type "application/pgp-signature" skipped