netdev - [RFC PATCH 3/4] b44: Unmap DMA ring buffers before kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201912080838.xB88cSTa015147@sdf.org>
Date:   Sun, 8 Dec 2019 08:38:28 GMT
From:   George Spelvin <lkml@....org>
To:     michael.chan@...adcom.com, netdev@...r.kernel.org
Cc:     hauke@...ke-m.de, lkml@....org
Subject: [RFC PATCH 3/4] b44: Unmap DMA ring buffers before kfree

It's an unlikely error path during initialization, but let's
not leak DMA mappings.

Also the condition for an unacceptable mapping is corrected from
dma_addr + len > 0x3fffffff to dma_addr + len > 0x40000000, as in
the previous patch.

Signed-off-by: George Spelvin <lkml@....org>
---
 drivers/net/ethernet/broadcom/b44.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index e540d5646aef..90e25a1f284f 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -1226,8 +1226,12 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
 					     DMA_TABLE_BYTES,
 					     DMA_BIDIRECTIONAL);
 
-		if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma) ||
-			rx_ring_dma + size > DMA_BIT_MASK(30)) {
+		if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma))
+			goto rx_failed;
+		if (rx_ring_dma + size > DMA_BIT_MASK(30)+1) {
+			dma_unmap_single(bp->sdev->dma_dev, rx_ring_dma,
+					 DMA_TABLE_BYTES, DMA_BIDIRECTIONAL);
+rx_failed:
 			kfree(rx_ring);
 			goto out_err;
 		}
@@ -1254,8 +1258,12 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
 					     DMA_TABLE_BYTES,
 					     DMA_TO_DEVICE);
 
-		if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma) ||
-			tx_ring_dma + size > DMA_BIT_MASK(30)) {
+		if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma))
+			goto tx_failed;
+		if (tx_ring_dma + size > DMA_BIT_MASK(30)+1) {
+			dma_unmap_single(bp->sdev->dma_dev, tx_ring_dma,
+					 DMA_TABLE_BYTES, DMA_TO_DEVICE);
+tx_failed:
 			kfree(tx_ring);
 			goto out_err;
 		}
-- 
2.24.0