Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1667098

[PATCH 4.4 31/46] net: adaptec: starfire: add checks for dma mapping errors

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 31/46] net: adaptec: starfire: add checks for dma mapping errors
Date 2017-06-15 20:40 +0200
Message-ID <tSHQt-5ZL-3@gated-at.bofh.it> (permalink)
References <tSHdL-5vC-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Khoroshilov <khoroshilov@ispras.ru>


[ Upstream commit d1156b489fa734d1af763d6a07b1637c01bb0aed ]

init_ring(), refill_rx_ring() and start_tx() don't check
if mapping dma memory succeed.
The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/adaptec/starfire.c |   45 ++++++++++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/adaptec/starfire.c
+++ b/drivers/net/ethernet/adaptec/starfire.c
@@ -1153,6 +1153,12 @@ static void init_ring(struct net_device
 		if (skb == NULL)
 			break;
 		np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+		if (pci_dma_mapping_error(np->pci_dev,
+					  np->rx_info[i].mapping)) {
+			dev_kfree_skb(skb);
+			np->rx_info[i].skb = NULL;
+			break;
+		}
 		/* Grrr, we cannot offset to correctly align the IP header. */
 		np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | RxDescValid);
 	}
@@ -1183,8 +1189,9 @@ static netdev_tx_t start_tx(struct sk_bu
 {
 	struct netdev_private *np = netdev_priv(dev);
 	unsigned int entry;
+	unsigned int prev_tx;
 	u32 status;
-	int i;
+	int i, j;
 
 	/*
 	 * be cautious here, wrapping the queue has weird semantics
@@ -1202,6 +1209,7 @@ static netdev_tx_t start_tx(struct sk_bu
 	}
 #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */
 
+	prev_tx = np->cur_tx;
 	entry = np->cur_tx % TX_RING_SIZE;
 	for (i = 0; i < skb_num_frags(skb); i++) {
 		int wrap_ring = 0;
@@ -1235,6 +1243,11 @@ static netdev_tx_t start_tx(struct sk_bu
 					       skb_frag_size(this_frag),
 					       PCI_DMA_TODEVICE);
 		}
+		if (pci_dma_mapping_error(np->pci_dev,
+					  np->tx_info[entry].mapping)) {
+			dev->stats.tx_dropped++;
+			goto err_out;
+		}
 
 		np->tx_ring[entry].addr = cpu_to_dma(np->tx_info[entry].mapping);
 		np->tx_ring[entry].status = cpu_to_le32(status);
@@ -1269,8 +1282,30 @@ static netdev_tx_t start_tx(struct sk_bu
 		netif_stop_queue(dev);
 
 	return NETDEV_TX_OK;
-}
 
+err_out:
+	entry = prev_tx % TX_RING_SIZE;
+	np->tx_info[entry].skb = NULL;
+	if (i > 0) {
+		pci_unmap_single(np->pci_dev,
+				 np->tx_info[entry].mapping,
+				 skb_first_frag_len(skb),
+				 PCI_DMA_TODEVICE);
+		np->tx_info[entry].mapping = 0;
+		entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE;
+		for (j = 1; j < i; j++) {
+			pci_unmap_single(np->pci_dev,
+					 np->tx_info[entry].mapping,
+					 skb_frag_size(
+						&skb_shinfo(skb)->frags[j-1]),
+					 PCI_DMA_TODEVICE);
+			entry++;
+		}
+	}
+	dev_kfree_skb_any(skb);
+	np->cur_tx = prev_tx;
+	return NETDEV_TX_OK;
+}
 
 /* The interrupt handler does all of the Rx thread work and cleans up
    after the Tx thread. */
@@ -1570,6 +1605,12 @@ static void refill_rx_ring(struct net_de
 				break;	/* Better luck next round. */
 			np->rx_info[entry].mapping =
 				pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+			if (pci_dma_mapping_error(np->pci_dev,
+						np->rx_info[entry].mapping)) {
+				dev_kfree_skb(skb);
+				np->rx_info[entry].skb = NULL;
+				break;
+			}
 			np->rx_ring[entry].rxaddr =
 				cpu_to_dma(np->rx_info[entry].mapping | RxDescValid);
 		}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/46] 4.4.73-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 21/46] ethtool: do not vzalloc(0) on registers dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 27/46] drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 33/46] drm/nouveau: Dont enabling polling twice on runtime resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 09/46] ipv6: Inhibit IPv4-mapped src address on the wire. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 32/46] parisc, parport_gsc: Fixes for printk continuation lines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 45/46] s390/kvm: do not rely on the ILC on kvm host protection fauls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 17/46] PM / runtime: Avoid false-positive warnings from might_sleep_if() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 37/46] r8152: re-schedule napi for tx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 22/46] fscache: Fix dead object requeue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 28/46] net/mlx4_core: Avoid command timeouts during VF driver device shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 44/46] xtensa: dont use linux IRQ #0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 41/46] romfs: use different way to generate fsid for BLOCK or MTD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 46/46] sparc64: make string buffers large enough Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 38/46] r8152: fix rtl8152_post_reset function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 42/46] proc: add a schedule point in proc_pid_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 39/46] r8152: avoid start_xmit to schedule napi when napi is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 31/46] net: adaptec: starfire: add checks for dma mapping errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 24/46] FS-Cache: Initialise stores_lock in netfs cookie Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 30/46] pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 11/46] NET: mkiss: Fix panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 04/46] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 07/46] net: xilinx_emaclite: fix receive buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 08/46] ipv6: Handle IPv4-mapped src to in6addr_any dst. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 18/46] jump label: pass kbuild_cflags when checking for asm goto support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 29/46] gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 12/46] net: hns: Fix the device being used for dma mapping during TX Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 35/46] ravb: unmap descriptors when freeing rings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 03/46] ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 23/46] fscache: Clear outstanding writes when disabling a cookie Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 15/46] i2c: piix4: Fix request_region size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 10/46] NET: Fix /proc/net/arp for AX.25 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 25/46] ipv6: fix flow labels when the traffic class is non-0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 36/46] nfs: Fix "Dont increment lock sequence ID after NFS4ERR_MOVED" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 34/46] drm/ast: Fixed system hanged if disable P2A Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 26/46] drm/nouveau: prevent userspace from deleting client object Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 05/46] Call echo service immediately after socket reconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 40/46] sctp: sctp_addr_id2transport should verify the addr before looking up assoc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 20/46] log2: make order_base_2() behave correctly on const input value zero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  Re: [PATCH 4.4 00/46] 4.4.73-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-16 00:30 +0200
  Re: [PATCH 4.4 00/46] 4.4.73-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-16 02:40 +0200

csiph-web