netdev - Re: [PATCH v6 4/9] bgmac: simplify/optimize rx DMA error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <552CDD58.5030904@openwrt.org>
Date:	Tue, 14 Apr 2015 11:26:48 +0200
From:	Felix Fietkau <nbd@...nwrt.org>
To:	Rafał Miłecki <zajec5@...il.com>
CC:	Network Development <netdev@...r.kernel.org>,
	Hauke Mehrtens <hauke@...ke-m.de>
Subject: Re: [PATCH v6 4/9] bgmac: simplify/optimize rx DMA error handling

On 2015-04-14 11:19, Rafał Miłecki wrote:
> On 14 April 2015 at 11:13, Felix Fietkau <nbd@...nwrt.org> wrote:
>> On 2015-04-14 07:55, Rafał Miłecki wrote:
>>> On 14 April 2015 at 01:42, Felix Fietkau <nbd@...nwrt.org> wrote:
>>>> @@ -528,14 +524,14 @@ static void bgmac_dma_rx_ring_free(struct bgmac *bgmac,
>>>>
>>>>         for (i = 0; i < ring->num_slots; i++) {
>>>>                 slot = &ring->slots[i];
>>>> -               if (!slot->buf)
>>>> +               if (!slot->dma_addr)
>>>>                         continue;
>>>
>>> I think it breaks error path of bgmac_dma_alloc. It may happen that
>>> during DMA alloc we alloc skb and then we fail to map it. In such case
>>> buf should be freed. Please trace how bgmac_dma_free is used in
>>> bgmac_dma_alloc.
>> I don't think so: bgmac_dma_rx_skb_for_slot handles both buffer
>> allocation and dma mapping. If dma mapping fails, the buffer is freed
>> before any part of the slot is overwritten.
> 
> Oops, I think I just spotted a memory leak then.
> 
> If bgmac_dma_rx_skb_for_slot fails to do DMA mapping it returns an
> error without freeing a skb.
It neither allocates, nor frees an skb - I should probably rename that
function in a later patch round.

Allocation does:
	buf = netdev_alloc_frag(BGMAC_RX_ALLOC_SIZE);

When handling a DMA mapping error, it does this:
	put_page(virt_to_head_page(buf));

Where's the memory leak?

- Felix
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html