| Message ID | 1421286191-9550-1-git-send-email-kgene@kernel.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thu, Jan 15, 2015 at 10:43:11AM +0900, Kukjin Kim wrote: > rx_ring->rx_skbuff = kmalloc_array(rx_rsize, > sizeof(struct sk_buff *), GFP_KERNEL); > - if (rx_ring->rx_skbuff == NULL) > - goto rxbuff_err; > + if (!rx_ring->rx_skbuff) { This is missing a dma_free_coherent() here. > + kfree(rx_ring->rx_skbuff_dma); > + goto error; > + } > > /* initialise the buffers */ > for (desc_index = 0; desc_index < rx_rsize; desc_index++) { > @@ -502,13 +508,6 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no, > err_init_rx_buffers: > while (--desc_index >= 0) > free_rx_ring(priv->device, rx_ring, desc_index); > - kfree(rx_ring->rx_skbuff); The double free bug is that free_rx_ring() frees kfree(rx_ring->rx_skbuff_dma); and kfree(rx_ring->rx_skbuff); so just calling it in a loop here will cause a double free. Also free_rx_ring() doesn't take an index parameter, it takes a size parameter. The right way to fix this is to create a release function that mirrors sxgbe_init_rx_buffers(). static void sxgbe_free_rx_buffers(struct net_device *dev, struct sxgbe_rx_norm_desc *p, int i, unsigned int dma_buf_sz, struct sxgbe_rx_queue *rx_ring) { struct sxgbe_priv_data *priv = netdev_priv(dev); kfree_skb(rx_ring->rx_skbuff[i]); dma_unmap_single(priv->device, rx_ring->rx_skbuff_dma[i], dma_buf_sz, DMA_FROM_DEVICE); } Then just swap that into the free loop instead of the free_rx_ring(). err_init_rx_buffers: while (--desc_index >= 0) { struct sxgbe_rx_norm_desc *p; p = rx_ring->dma_rx + desc_index; sxgbe_init_rx_buffers(dev, p, desc_index, bfsize, rx_ring); } kfree(rx_ring->rx_skbuff); Something like that. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Kukjin Kim <kgene@kernel.org> Date: Thu, 15 Jan 2015 10:43:11 +0900 > From: Byungho An <bh74.an@samsung.com> > > This patch fixes double kfree() calls at init_rx_ring() because > it causes static checker warning. > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Byungho An <bh74.an@samsung.com> > Signed-off-by: Kukjin Kim <kgene@kernel.org> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jan 15, 2015 at 07:14:16PM -0500, David Miller wrote: > From: Kukjin Kim <kgene@kernel.org> > Date: Thu, 15 Jan 2015 10:43:11 +0900 > > > From: Byungho An <bh74.an@samsung.com> > > > > This patch fixes double kfree() calls at init_rx_ring() because > > it causes static checker warning. > > > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > > Signed-off-by: Byungho An <bh74.an@samsung.com> > > Signed-off-by: Kukjin Kim <kgene@kernel.org> > > Applied. It does silence the warning but it doesn't fix the bug. Kukjin, let me know if you have any questions. I can write the fix if you need me to. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c index 6984944..fe7538d 100644 --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c @@ -474,13 +474,19 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no, /* allocate memory for RX skbuff array */ rx_ring->rx_skbuff_dma = kmalloc_array(rx_rsize, sizeof(dma_addr_t), GFP_KERNEL); - if (rx_ring->rx_skbuff_dma == NULL) - goto dmamem_err; + if (!rx_ring->rx_skbuff_dma) { + dma_free_coherent(priv->device, + rx_rsize * sizeof(struct sxgbe_rx_norm_desc), + rx_ring->dma_rx, rx_ring->dma_rx_phy); + goto error; + } rx_ring->rx_skbuff = kmalloc_array(rx_rsize, sizeof(struct sk_buff *), GFP_KERNEL); - if (rx_ring->rx_skbuff == NULL) - goto rxbuff_err; + if (!rx_ring->rx_skbuff) { + kfree(rx_ring->rx_skbuff_dma); + goto error; + } /* initialise the buffers */ for (desc_index = 0; desc_index < rx_rsize; desc_index++) { @@ -502,13 +508,6 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no, err_init_rx_buffers: while (--desc_index >= 0) free_rx_ring(priv->device, rx_ring, desc_index); - kfree(rx_ring->rx_skbuff); -rxbuff_err: - kfree(rx_ring->rx_skbuff_dma); -dmamem_err: - dma_free_coherent(priv->device, - rx_rsize * sizeof(struct sxgbe_rx_norm_desc), - rx_ring->dma_rx, rx_ring->dma_rx_phy); error: return -ENOMEM; }