netdev - Re: [PATCH v6 4/9] bgmac: simplify/optimize rx DMA error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACna6rxoCobPSF2ihB2k6kGWf7vzmMZyjHo19JwZ854rr7V=Wg@mail.gmail.com>
Date:	Tue, 14 Apr 2015 11:32:49 +0200
From:	Rafał Miłecki <zajec5@...il.com>
To:	Felix Fietkau <nbd@...nwrt.org>
Cc:	Network Development <netdev@...r.kernel.org>,
	Hauke Mehrtens <hauke@...ke-m.de>
Subject: Re: [PATCH v6 4/9] bgmac: simplify/optimize rx DMA error handling

On 14 April 2015 at 11:26, Felix Fietkau <nbd@...nwrt.org> wrote:
> On 2015-04-14 11:19, Rafał Miłecki wrote:
>> On 14 April 2015 at 11:13, Felix Fietkau <nbd@...nwrt.org> wrote:
>>> On 2015-04-14 07:55, Rafał Miłecki wrote:
>>>> On 14 April 2015 at 01:42, Felix Fietkau <nbd@...nwrt.org> wrote:
>>>>> @@ -528,14 +524,14 @@ static void bgmac_dma_rx_ring_free(struct bgmac *bgmac,
>>>>>
>>>>>         for (i = 0; i < ring->num_slots; i++) {
>>>>>                 slot = &ring->slots[i];
>>>>> -               if (!slot->buf)
>>>>> +               if (!slot->dma_addr)
>>>>>                         continue;
>>>>
>>>> I think it breaks error path of bgmac_dma_alloc. It may happen that
>>>> during DMA alloc we alloc skb and then we fail to map it. In such case
>>>> buf should be freed. Please trace how bgmac_dma_free is used in
>>>> bgmac_dma_alloc.
>>> I don't think so: bgmac_dma_rx_skb_for_slot handles both buffer
>>> allocation and dma mapping. If dma mapping fails, the buffer is freed
>>> before any part of the slot is overwritten.
>>
>> Oops, I think I just spotted a memory leak then.
>>
>> If bgmac_dma_rx_skb_for_slot fails to do DMA mapping it returns an
>> error without freeing a skb.
> It neither allocates, nor frees an skb - I should probably rename that
> function in a later patch round.
>
> Allocation does:
>         buf = netdev_alloc_frag(BGMAC_RX_ALLOC_SIZE);
>
> When handling a DMA mapping error, it does this:
>         put_page(virt_to_head_page(buf));
>
> Where's the memory leak?

I mean the buf, not skb, sorry:
buf = netdev_alloc_frag(BGMAC_RX_ALLOC_SIZE);

if (dma_mapping_error(dma_dev, dma_addr)) {
        LACKING free(buf) HERE
        return -ENOMEM;
}

-- 
Rafał
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html