From patchwork Tue Aug 6 15:01:14 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Jones X-Patchwork-Id: 265079 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C9C3F2C0089 for ; Wed, 7 Aug 2013 01:04:18 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755127Ab3HFPEP (ORCPT ); Tue, 6 Aug 2013 11:04:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:10533 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753954Ab3HFPEO (ORCPT ); Tue, 6 Aug 2013 11:04:14 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r76F41xp016587 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 6 Aug 2013 11:04:02 -0400 Received: from gelk.kernelslacker.org (ovpn-113-137.phx2.redhat.com [10.3.113.137]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r76F3r5B014818 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 6 Aug 2013 11:03:59 -0400 Received: from gelk.kernelslacker.org (localhost [127.0.0.1]) by gelk.kernelslacker.org (8.14.7/8.14.7) with ESMTP id r76F3q6a010879; Tue, 6 Aug 2013 11:03:52 -0400 Received: (from davej@localhost) by gelk.kernelslacker.org (8.14.7/8.14.7/Submit) id r76F1FA5007519; Tue, 6 Aug 2013 11:01:15 -0400 X-Authentication-Warning: gelk.kernelslacker.org: davej set sender to davej@redhat.com using -f Date: Tue, 6 Aug 2013 11:01:14 -0400 From: Dave Jones To: netdev@vger.kernel.org Cc: Neil Horman , "David S. Miller" , Francois Romieu Subject: Re: 8139cp: Add dma_mapping_error checking Message-ID: <20130806150114.GA29184@redhat.com> References: <20130804005227.CA1B0660D02@gitolite.kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20130804005227.CA1B0660D02@gitolite.kernel.org> User-Agent: Mutt/1.5.21 (2010-09-15) X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Sun, Aug 04, 2013 at 12:52:27AM +0000, Linux Kernel wrote: > Gitweb: http://git.kernel.org/linus/;a=commit;h=cf3c4c03060b688cbc389ebc5065ebcce5653e96 > Commit: cf3c4c03060b688cbc389ebc5065ebcce5653e96 > Parent: d9d10a30964504af834d8d250a0c76d4ae91eb1e > Author: Neil Horman > AuthorDate: Wed Jul 31 09:03:56 2013 -0400 > Committer: David S. Miller > CommitDate: Wed Jul 31 17:01:43 2013 -0700 > > 8139cp: Add dma_mapping_error checking > > Self explanitory dma_mapping_error addition to the 8139 driver, based on this: > https://bugzilla.redhat.com/show_bug.cgi?id=947250 > > It showed several backtraces arising for dma_map_* usage without checking the > return code on the mapping. Add the check and abort the rx/tx operation if its > failed. Untested as I have no hardware and the reporter has wandered off, but > seems pretty straightforward. > > Signed-off-by: Neil Horman > CC: "David S. Miller" > CC: Francois Romieu > Signed-off-by: David S. Miller > > diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c .. (allocation of new_skb occurs) > + new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen, > + PCI_DMA_FROMDEVICE); > + if (dma_mapping_error(&cp->pdev->dev, new_mapping)) { > + dev->stats.rx_dropped++; > + goto rx_next; > + } > + ... 547 rx_next: 548 cp->rx_ring[rx_tail].opts2 = 0; 549 cp->rx_ring[rx_tail].addr = cpu_to_le64(mapping); 550 if (rx_tail == (CP_RX_RING_SIZE - 1)) 551 desc->opts1 = cpu_to_le32(DescOwn | RingEnd | 552 cp->rx_buf_sz); 553 else 554 desc->opts1 = cpu_to_le32(DescOwn | cp->rx_buf_sz); 555 rx_tail = NEXT_RX(rx_tail); 556 557 if (rx >= budget) 558 break; 559 } If we get to that 'break', we leak new_skb. This maybe.... ? Dave 8139cp: Fix skb leak in rx_status_loop failure path. Introduced in cf3c4c03060b688cbc389ebc5065ebcce5653e96 Signed-off-by: Dave Jones --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c index 6f35f84..d2e5919 100644 --- a/drivers/net/ethernet/realtek/8139cp.c +++ b/drivers/net/ethernet/realtek/8139cp.c @@ -524,6 +524,7 @@ rx_status_loop: PCI_DMA_FROMDEVICE); if (dma_mapping_error(&cp->pdev->dev, new_mapping)) { dev->stats.rx_dropped++; + kfree_skb(new_skb); goto rx_next; }