lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Sun, 8 Dec 2019 08:38:28 GMT
From:   George Spelvin <lkml@....org>
To:     michael.chan@...adcom.com, netdev@...r.kernel.org
Cc:     hauke@...ke-m.de, lkml@....org
Subject: [RFC PATCH 3/4] b44: Unmap DMA ring buffers before kfree

It's an unlikely error path during initialization, but let's
not leak DMA mappings.

Also the condition for an unacceptable mapping is corrected from
dma_addr + len > 0x3fffffff to dma_addr + len > 0x40000000, as in
the previous patch.

Signed-off-by: George Spelvin <lkml@....org>
---
 drivers/net/ethernet/broadcom/b44.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index e540d5646aef..90e25a1f284f 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -1226,8 +1226,12 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
 					     DMA_TABLE_BYTES,
 					     DMA_BIDIRECTIONAL);
 
-		if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma) ||
-			rx_ring_dma + size > DMA_BIT_MASK(30)) {
+		if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma))
+			goto rx_failed;
+		if (rx_ring_dma + size > DMA_BIT_MASK(30)+1) {
+			dma_unmap_single(bp->sdev->dma_dev, rx_ring_dma,
+					 DMA_TABLE_BYTES, DMA_BIDIRECTIONAL);
+rx_failed:
 			kfree(rx_ring);
 			goto out_err;
 		}
@@ -1254,8 +1258,12 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
 					     DMA_TABLE_BYTES,
 					     DMA_TO_DEVICE);
 
-		if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma) ||
-			tx_ring_dma + size > DMA_BIT_MASK(30)) {
+		if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma))
+			goto tx_failed;
+		if (tx_ring_dma + size > DMA_BIT_MASK(30)+1) {
+			dma_unmap_single(bp->sdev->dma_dev, tx_ring_dma,
+					 DMA_TABLE_BYTES, DMA_TO_DEVICE);
+tx_failed:
 			kfree(tx_ring);
 			goto out_err;
 		}
-- 
2.24.0

Powered by blists - more mailing lists