netdev - BUG: Wrong dma queue handling in ixp4 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 Jul 2016 13:05:58 +0200
From:	"Lino Sanfilippo" <LinoSanfilippo@....de>
To:	khalasa@...p.pl
Cc:	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: BUG: Wrong dma queue handling in ixp4 driver

Hi,

maybe I miss something, but the ixp4 ethernet driver seems to handle dma pools 
in a wrong way: In init_queues() it creates a dma pool for descriptors and then
 only allocates a single descriptor from this pool. The author seems to assume the whole
table has been allocated already, since after that the complete pool size is zeroed:

<snip> 
static int init_queues(struct port *port)
{
	int i;

	if (!ports_open) {
		dma_pool = dma_pool_create(DRV_NAME, &port->netdev->dev,
					   POOL_ALLOC_SIZE, 32, 0);
		if (!dma_pool)
			return -ENOMEM;
	}

	if (!(port->desc_tab = dma_pool_alloc(dma_pool, GFP_KERNEL,
					      &port->desc_tab_phys)))
		return -ENOMEM;
	memset(port->desc_tab, 0, POOL_ALLOC_SIZE);
<snap>

Regards,
Lino