* [PATCH net] be2net: add dma_mapping_error() check for dma_map_page()
@ 2014-01-14 18:28 Ivan Vecera
2014-01-15 7:36 ` Sathya Perla
0 siblings, 1 reply; 3+ messages in thread
From: Ivan Vecera @ 2014-01-14 18:28 UTC (permalink / raw)
To: netdev; +Cc: sathya.perla, subbu.seetharaman, ajit.khaparde
The driver does not check value returned by dma_map_page. The patch
fixes this as well as one additional bug. The prev_page_info is
dereferenced after 'for' loop but if the 1st be_alloc_pages fails its
value is NULL.
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
---
drivers/net/ethernet/emulex/benet/be_main.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index bf40fda..f2811b5 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
struct be_queue_info *rxq = &rxo->q;
struct page *pagep = NULL;
+ struct device *dev = &adapter->pdev->dev;
struct be_eth_rx_d *rxd;
u64 page_dmaaddr = 0, frag_dmaaddr;
u32 posted, page_offset = 0;
@@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
rx_stats(rxo)->rx_post_fail++;
break;
}
- page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
- 0, adapter->big_page_size,
+ page_dmaaddr = dma_map_page(dev, pagep, 0,
+ adapter->big_page_size,
DMA_FROM_DEVICE);
+ if (dma_mapping_error(dev, page_dmaaddr)) {
+ put_page(pagep);
+ pagep = NULL;
+ rx_stats(rxo)->rx_post_fail++;
+ break;
+ }
page_info->page_offset = 0;
} else {
get_page(pagep);
@@ -1816,7 +1823,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
queue_head_inc(rxq);
page_info = &rxo->page_info_tbl[rxq->head];
}
- if (pagep)
+ if (pagep && prev_page_info)
prev_page_info->last_page_user = true;
if (posted) {
--
1.8.3.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [PATCH net] be2net: add dma_mapping_error() check for dma_map_page()
2014-01-14 18:28 [PATCH net] be2net: add dma_mapping_error() check for dma_map_page() Ivan Vecera
@ 2014-01-15 7:36 ` Sathya Perla
2014-01-15 10:08 ` Ivan Vecera
0 siblings, 1 reply; 3+ messages in thread
From: Sathya Perla @ 2014-01-15 7:36 UTC (permalink / raw)
To: Ivan Vecera, netdev@vger.kernel.org
Cc: Subramanian Seetharaman, Ajit Khaparde
> -----Original Message-----
> From: Ivan Vecera [mailto:ivecera@redhat.com]
>
> The driver does not check value returned by dma_map_page. The patch
> fixes this as well as one additional bug. The prev_page_info is
> dereferenced after 'for' loop but if the 1st be_alloc_pages fails its
> value is NULL.
>
> Signed-off-by: Ivan Vecera <ivecera@redhat.com>
> ---
> drivers/net/ethernet/emulex/benet/be_main.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/emulex/benet/be_main.c
> b/drivers/net/ethernet/emulex/benet/be_main.c
> index bf40fda..f2811b5 100644
> --- a/drivers/net/ethernet/emulex/benet/be_main.c
> +++ b/drivers/net/ethernet/emulex/benet/be_main.c
> @@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
> struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
> struct be_queue_info *rxq = &rxo->q;
> struct page *pagep = NULL;
> + struct device *dev = &adapter->pdev->dev;
> struct be_eth_rx_d *rxd;
> u64 page_dmaaddr = 0, frag_dmaaddr;
> u32 posted, page_offset = 0;
> @@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
> rx_stats(rxo)->rx_post_fail++;
> break;
> }
> - page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
> - 0, adapter->big_page_size,
> + page_dmaaddr = dma_map_page(dev, pagep, 0,
> + adapter->big_page_size,
> DMA_FROM_DEVICE);
> + if (dma_mapping_error(dev, page_dmaaddr)) {
> + put_page(pagep);
> + pagep = NULL;
> + rx_stats(rxo)->rx_post_fail++;
> + break;
> + }
> page_info->page_offset = 0;
> } else {
> get_page(pagep);
> @@ -1816,7 +1823,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
> queue_head_inc(rxq);
> page_info = &rxo->page_info_tbl[rxq->head];
> }
> - if (pagep)
> + if (pagep && prev_page_info)
> prev_page_info->last_page_user = true;
Ivan, if the 1st be_alloc_pages() fails, won't "pagep" be NULL aswell.
In that case, "prev_page_info" will not be dereferenced.
>
> if (posted) {
> --
> 1.8.3.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] be2net: add dma_mapping_error() check for dma_map_page()
2014-01-15 7:36 ` Sathya Perla
@ 2014-01-15 10:08 ` Ivan Vecera
0 siblings, 0 replies; 3+ messages in thread
From: Ivan Vecera @ 2014-01-15 10:08 UTC (permalink / raw)
To: Sathya Perla, netdev@vger.kernel.org
Cc: Subramanian Seetharaman, Ajit Khaparde
On 01/15/2014 08:36 AM, Sathya Perla wrote:
>> -----Original Message-----
>> From: Ivan Vecera [mailto:ivecera@redhat.com]
>>
>> The driver does not check value returned by dma_map_page. The patch
>> fixes this as well as one additional bug. The prev_page_info is
>> dereferenced after 'for' loop but if the 1st be_alloc_pages fails its
>> value is NULL.
>>
>> Signed-off-by: Ivan Vecera <ivecera@redhat.com>
>> ---
>> drivers/net/ethernet/emulex/benet/be_main.c | 13 ++++++++++---
>> 1 file changed, 10 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/emulex/benet/be_main.c
>> b/drivers/net/ethernet/emulex/benet/be_main.c
>> index bf40fda..f2811b5 100644
>> --- a/drivers/net/ethernet/emulex/benet/be_main.c
>> +++ b/drivers/net/ethernet/emulex/benet/be_main.c
>> @@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>> struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
>> struct be_queue_info *rxq = &rxo->q;
>> struct page *pagep = NULL;
>> + struct device *dev = &adapter->pdev->dev;
>> struct be_eth_rx_d *rxd;
>> u64 page_dmaaddr = 0, frag_dmaaddr;
>> u32 posted, page_offset = 0;
>> @@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>> rx_stats(rxo)->rx_post_fail++;
>> break;
>> }
>> - page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
>> - 0, adapter->big_page_size,
>> + page_dmaaddr = dma_map_page(dev, pagep, 0,
>> + adapter->big_page_size,
>> DMA_FROM_DEVICE);
>> + if (dma_mapping_error(dev, page_dmaaddr)) {
>> + put_page(pagep);
>> + pagep = NULL;
>> + rx_stats(rxo)->rx_post_fail++;
>> + break;
>> + }
>> page_info->page_offset = 0;
>> } else {
>> get_page(pagep);
>> @@ -1816,7 +1823,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
>> queue_head_inc(rxq);
>> page_info = &rxo->page_info_tbl[rxq->head];
>> }
>> - if (pagep)
>> + if (pagep && prev_page_info)
>> prev_page_info->last_page_user = true;
>
> Ivan, if the 1st be_alloc_pages() fails, won't "pagep" be NULL aswell.
> In that case, "prev_page_info" will not be dereferenced.
>
Sure Sathya, sorry... my bad eyes... Will post 2nd version.
Ivan
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-01-15 10:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-14 18:28 [PATCH net] be2net: add dma_mapping_error() check for dma_map_page() Ivan Vecera
2014-01-15 7:36 ` Sathya Perla
2014-01-15 10:08 ` Ivan Vecera
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).