netdev - Re: [PATCH net] be2net: add dma_mapping_error() check for dma_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <52D65E01.5030306@redhat.com>
Date:	Wed, 15 Jan 2014 11:08:01 +0100
From:	Ivan Vecera <ivecera@...hat.com>
To:	Sathya Perla <Sathya.Perla@...lex.Com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:	Subramanian Seetharaman <subbu.seetharaman@...lex.Com>,
	Ajit Khaparde <Ajit.Khaparde@...lex.Com>
Subject: Re: [PATCH net] be2net: add dma_mapping_error() check for dma_map_page()

On 01/15/2014 08:36 AM, Sathya Perla wrote:
>> -----Original Message-----
>> From: Ivan Vecera [mailto:ivecera@...hat.com]
>>
>> The driver does not check value returned by dma_map_page. The patch
>> fixes this as well as one additional bug. The prev_page_info is
>> dereferenced after 'for' loop but if the 1st be_alloc_pages fails its
>> value is NULL.
>>
>> Signed-off-by: Ivan Vecera <ivecera@...hat.com>
>> ---
>>   drivers/net/ethernet/emulex/benet/be_main.c | 13 ++++++++++---
>>   1 file changed, 10 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/emulex/benet/be_main.c
>> b/drivers/net/ethernet/emulex/benet/be_main.c
>> index bf40fda..f2811b5 100644
>> --- a/drivers/net/ethernet/emulex/benet/be_main.c
>> +++ b/drivers/net/ethernet/emulex/benet/be_main.c
>> @@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>>   	struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
>>   	struct be_queue_info *rxq = &rxo->q;
>>   	struct page *pagep = NULL;
>> +	struct device *dev = &adapter->pdev->dev;
>>   	struct be_eth_rx_d *rxd;
>>   	u64 page_dmaaddr = 0, frag_dmaaddr;
>>   	u32 posted, page_offset = 0;
>> @@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>>   				rx_stats(rxo)->rx_post_fail++;
>>   				break;
>>   			}
>> -			page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
>> -						    0, adapter->big_page_size,
>> +			page_dmaaddr = dma_map_page(dev, pagep, 0,
>> +						    adapter->big_page_size,
>>   						    DMA_FROM_DEVICE);
>> +			if (dma_mapping_error(dev, page_dmaaddr)) {
>> +				put_page(pagep);
>> +				pagep = NULL;
>> +				rx_stats(rxo)->rx_post_fail++;
>> +				break;
>> +			}
>>   			page_info->page_offset = 0;
>>   		} else {
>>   			get_page(pagep);
>> @@ -1816,7 +1823,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>>   		queue_head_inc(rxq);
>>   		page_info = &rxo->page_info_tbl[rxq->head];
>>   	}
>> -	if (pagep)
>> +	if (pagep && prev_page_info)
>>   		prev_page_info->last_page_user = true;
>
> Ivan, if the 1st be_alloc_pages() fails, won't "pagep" be NULL aswell.
> In that case, "prev_page_info" will not be dereferenced.
>
Sure Sathya, sorry... my bad eyes... Will post 2nd version.

Ivan

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html