netdev - RE: [PATCH net] be2net: add dma_mapping_error() check for dma_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89af1a0a-785c-4dfd-93c5-b1be112d5f60@CMEXHTCAS1.ad.emulex.com>
Date:	Wed, 15 Jan 2014 07:36:32 +0000
From:	Sathya Perla <Sathya.Perla@...lex.Com>
To:	Ivan Vecera <ivecera@...hat.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:	Subramanian Seetharaman <subbu.seetharaman@...lex.com>,
	Ajit Khaparde <Ajit.Khaparde@...lex.Com>
Subject: RE: [PATCH net] be2net: add dma_mapping_error() check for
 dma_map_page()

> -----Original Message-----
> From: Ivan Vecera [mailto:ivecera@...hat.com]
> 
> The driver does not check value returned by dma_map_page. The patch
> fixes this as well as one additional bug. The prev_page_info is
> dereferenced after 'for' loop but if the 1st be_alloc_pages fails its
> value is NULL.
> 
> Signed-off-by: Ivan Vecera <ivecera@...hat.com>
> ---
>  drivers/net/ethernet/emulex/benet/be_main.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/emulex/benet/be_main.c
> b/drivers/net/ethernet/emulex/benet/be_main.c
> index bf40fda..f2811b5 100644
> --- a/drivers/net/ethernet/emulex/benet/be_main.c
> +++ b/drivers/net/ethernet/emulex/benet/be_main.c
> @@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>  	struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
>  	struct be_queue_info *rxq = &rxo->q;
>  	struct page *pagep = NULL;
> +	struct device *dev = &adapter->pdev->dev;
>  	struct be_eth_rx_d *rxd;
>  	u64 page_dmaaddr = 0, frag_dmaaddr;
>  	u32 posted, page_offset = 0;
> @@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>  				rx_stats(rxo)->rx_post_fail++;
>  				break;
>  			}
> -			page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
> -						    0, adapter->big_page_size,
> +			page_dmaaddr = dma_map_page(dev, pagep, 0,
> +						    adapter->big_page_size,
>  						    DMA_FROM_DEVICE);
> +			if (dma_mapping_error(dev, page_dmaaddr)) {
> +				put_page(pagep);
> +				pagep = NULL;
> +				rx_stats(rxo)->rx_post_fail++;
> +				break;
> +			}
>  			page_info->page_offset = 0;
>  		} else {
>  			get_page(pagep);
> @@ -1816,7 +1823,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>  		queue_head_inc(rxq);
>  		page_info = &rxo->page_info_tbl[rxq->head];
>  	}
> -	if (pagep)
> +	if (pagep && prev_page_info)
>  		prev_page_info->last_page_user = true;

Ivan, if the 1st be_alloc_pages() fails, won't "pagep" be NULL aswell.
In that case, "prev_page_info" will not be dereferenced.

> 
>  	if (posted) {
> --
> 1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html