[PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Zhengchao Shao]

After the DMA buffer is mapped to a physical address, address is stored
in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
and later unmap the DMA buffer. But when count is always equal to
pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
will not be unmapped anyway.

Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index cec53f934940..45fbcbdc7d9e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -347,8 +347,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev,
 		count++;
 	} while (count < pktids->array_size);
 
-	if (count == pktids->array_size)
+	if (count == pktids->array_size) {
+		dma_unmap_single(dev, *physaddr, skb->len - data_offset,
+				 pktids->direction);
 		return -ENOMEM;
+	}
 
 	array[*idx].data_offset = data_offset;
 	array[*idx].physaddr = *physaddr;
-- 
2.34.1

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Kalle Valo]

Zhengchao Shao <shaozhengchao@huawei.com> wrote:

> After the DMA buffer is mapped to a physical address, address is stored
> in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
> brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
> and later unmap the DMA buffer. But when count is always equal to
> pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
> will not be unmapped anyway.
> 
> Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

Can someone review this?

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20221207013114.1748936-1-shaozhengchao@huawei.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Sebastian Andrzej Siewior]

On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
> Zhengchao Shao <shaozhengchao@huawei.com> wrote:
> 
> > After the DMA buffer is mapped to a physical address, address is stored
> > in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
> > brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
> > and later unmap the DMA buffer. But when count is always equal to
> > pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
> > will not be unmapped anyway.
> > 
> > Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
> > Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> 
> Can someone review this?

After looking at the code, that skb is mapped but not inserted into the
ringbuffer in this condition. The function returns with an error and the
caller will free that skb (or add to a list for later). Either way the
skb remains mapped which is wrong. The unmap here is the right thing to
do.

Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Sebastian

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Kalle Valo]

Sebastian Andrzej Siewior <bigeasy@linutronix.de> writes:

> On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
>> Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>> 
>> > After the DMA buffer is mapped to a physical address, address is stored
>> > in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
>> > brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
>> > and later unmap the DMA buffer. But when count is always equal to
>> > pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
>> > will not be unmapped anyway.
>> > 
>> > Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
>> > Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>> 
>> Can someone review this?
>
> After looking at the code, that skb is mapped but not inserted into the
> ringbuffer in this condition. The function returns with an error and the
> caller will free that skb (or add to a list for later). Either way the
> skb remains mapped which is wrong. The unmap here is the right thing to
> do.
>
> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Thanks for the review, very much appreciated.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[shaozhengchao]

On 2022/12/22 16:46, Kalle Valo wrote:
> Sebastian Andrzej Siewior <bigeasy@linutronix.de> writes:
> 
>> On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
>>> Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>>>
>>>> After the DMA buffer is mapped to a physical address, address is stored
>>>> in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
>>>> brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
>>>> and later unmap the DMA buffer. But when count is always equal to
>>>> pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
>>>> will not be unmapped anyway.
>>>>
>>>> Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
>>>> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>>>
>>> Can someone review this?
>>
>> After looking at the code, that skb is mapped but not inserted into the
>> ringbuffer in this condition. The function returns with an error and the
>> caller will free that skb (or add to a list for later). Either way the
>> skb remains mapped which is wrong. The unmap here is the right thing to
>> do.
>>
>> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> 
> Thanks for the review, very much appreciated.
> 

Thank you very much.

Zhengchao Shao

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 1445 bytes --]

On 12/22/2022 9:52 AM, shaozhengchao wrote:
> 
> 
> On 2022/12/22 16:46, Kalle Valo wrote:
>> Sebastian Andrzej Siewior <bigeasy@linutronix.de> writes:
>>
>>> On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
>>>> Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>>>>
>>>>> After the DMA buffer is mapped to a physical address, address is 
>>>>> stored
>>>>> in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
>>>>> brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain 
>>>>> physaddr
>>>>> and later unmap the DMA buffer. But when count is always equal to
>>>>> pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
>>>>> will not be unmapped anyway.
>>>>>
>>>>> Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
>>>>> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>>>>
>>>> Can someone review this?
>>>
>>> After looking at the code, that skb is mapped but not inserted into the
>>> ringbuffer in this condition. The function returns with an error and the
>>> caller will free that skb (or add to a list for later). Either way the
>>> skb remains mapped which is wrong. The unmap here is the right thing to
>>> do.
>>>
>>> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
>>
>> Thanks for the review, very much appreciated.
>>
> 
> Thank you very much.

Good catch. Has this path been observed or is this found by inspecting 
the code? Just curious.

Regards,
Arend

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

RE: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[shaozhengchao]

-----Original Message-----
From: Arend van Spriel [mailto:arend.vanspriel@broadcom.com] 
Sent: Thursday, December 22, 2022 7:00 PM
To: shaozhengchao <shaozhengchao@huawei.com>; Kalle Valo <kvalo@kernel.org>; Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: netdev@vger.kernel.org; linux-wireless@vger.kernel.org; brcm80211-dev-list.pdl@broadcom.com; SHA-cyfmac-dev-list@infineon.com; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com; aspriel@gmail.com; franky.lin@broadcom.com; hante.meuleman@broadcom.com; wright.feng@cypress.com; chi-hsien.lin@cypress.com; a.fatoum@pengutronix.de; alsi@bang-olufsen.dk; pieterpg@broadcom.com; dekim@broadcom.com; linville@tuxdriver.com; weiyongjun (A) <weiyongjun1@huawei.com>; yuehaibing <yuehaibing@huawei.com>
Subject: Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

On 12/22/2022 9:52 AM, shaozhengchao wrote:
> 
> 
> On 2022/12/22 16:46, Kalle Valo wrote:
>> Sebastian Andrzej Siewior <bigeasy@linutronix.de> writes:
>>
>>> On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
>>>> Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>>>>
>>>>> After the DMA buffer is mapped to a physical address, address is 
>>>>> stored
>>>>> in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
>>>>> brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain 
>>>>> physaddr
>>>>> and later unmap the DMA buffer. But when count is always equal to
>>>>> pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
>>>>> will not be unmapped anyway.
>>>>>
>>>>> Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
>>>>> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>>>>
>>>> Can someone review this?
>>>
>>> After looking at the code, that skb is mapped but not inserted into the
>>> ringbuffer in this condition. The function returns with an error and the
>>> caller will free that skb (or add to a list for later). Either way the
>>> skb remains mapped which is wrong. The unmap here is the right thing to
>>> do.
>>>
>>> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
>>
>> Thanks for the review, very much appreciated.
>>
> 
> Thank you very much.

>Good catch. Has this path been observed or is this found by inspecting 
>the code? Just curious.

>Regards,
>Arend

Hi Arend：
	I review code and find the bug. 

Zhengchao Shao

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 2530 bytes --]



On 12/22/2022 12:35 PM, shaozhengchao wrote:
> 
> 
> -----Original Message-----
> From: Arend van Spriel [mailto:arend.vanspriel@broadcom.com]
> Sent: Thursday, December 22, 2022 7:00 PM
> To: shaozhengchao <shaozhengchao@huawei.com>; Kalle Valo <kvalo@kernel.org>; Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Cc: netdev@vger.kernel.org; linux-wireless@vger.kernel.org; brcm80211-dev-list.pdl@broadcom.com; SHA-cyfmac-dev-list@infineon.com; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com; aspriel@gmail.com; franky.lin@broadcom.com; hante.meuleman@broadcom.com; wright.feng@cypress.com; chi-hsien.lin@cypress.com; a.fatoum@pengutronix.de; alsi@bang-olufsen.dk; pieterpg@broadcom.com; dekim@broadcom.com; linville@tuxdriver.com; weiyongjun (A) <weiyongjun1@huawei.com>; yuehaibing <yuehaibing@huawei.com>
> Subject: Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
> 
> On 12/22/2022 9:52 AM, shaozhengchao wrote:
>>
>>
>> On 2022/12/22 16:46, Kalle Valo wrote:
>>> Sebastian Andrzej Siewior <bigeasy@linutronix.de> writes:
>>>
>>>> On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
>>>>> Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>>>>>
>>>>>> After the DMA buffer is mapped to a physical address, address is
>>>>>> stored
>>>>>> in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
>>>>>> brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain
>>>>>> physaddr
>>>>>> and later unmap the DMA buffer. But when count is always equal to
>>>>>> pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
>>>>>> will not be unmapped anyway.
>>>>>>
>>>>>> Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
>>>>>> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>>>>>
>>>>> Can someone review this?
>>>>
>>>> After looking at the code, that skb is mapped but not inserted into the
>>>> ringbuffer in this condition. The function returns with an error and the
>>>> caller will free that skb (or add to a list for later). Either way the
>>>> skb remains mapped which is wrong. The unmap here is the right thing to
>>>> do.
>>>>
>>>> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
>>>
>>> Thanks for the review, very much appreciated.
>>>
>>
>> Thank you very much.
> 
>> Good catch. Has this path been observed or is this found by inspecting
>> the code? Just curious.
> 
>> Regards,
>> Arend
> 
> Hi Arend：
> 	I review code and find the bug.


Much appreciated.

Regards,
Arend

> Zhengchao Shao

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

Re: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

[Kalle Valo]

Zhengchao Shao <shaozhengchao@huawei.com> wrote:

> After the DMA buffer is mapped to a physical address, address is stored
> in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
> brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
> and later unmap the DMA buffer. But when count is always equal to
> pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
> will not be unmapped anyway.
> 
> Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Patch applied to wireless-next.git, thanks.

b9f420032f2b wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20221207013114.1748936-1-shaozhengchao@huawei.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches