From: Dave Jiang <dave.jiang@intel.com>
To: Baruch Siach <baruch@tkos.co.il>, Jon Mason <jdmason@kudzu.us>,
Allen Hubbe <allenbh@gmail.com>
Cc: Koichiro Den <den@valinux.co.jp>, ntb@lists.linux.dev
Subject: Re: [PATCH] NTB: ntb_transport: fix use after free
Date: Mon, 3 Nov 2025 10:45:10 -0700 [thread overview]
Message-ID: <92ff3abf-fd15-44f1-ac18-7a6ea049197d@intel.com> (raw)
In-Reply-To: <c4727cd0bdeb8385b893da59c5eb97a189bf4282.1762190599.git.baruch@tkos.co.il>
On 11/3/25 10:23 AM, Baruch Siach wrote:
> Don't call dmaengine_unmap_put() twice for the same pointer. This
> results in mempool_free() being called on a freed element.
>
> Fixes: 6f57fd0578df ("NTB: convert to dmaengine_unmap_data")
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>> ---
> drivers/ntb/ntb_transport.c | 22 +++++++++-------------
> 1 file changed, 9 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
> index eb875e3db2e3..809fb09658b4 100644
> --- a/drivers/ntb/ntb_transport.c
> +++ b/drivers/ntb/ntb_transport.c
> @@ -1573,14 +1573,14 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
> unmap->addr[0] = dma_map_page(device->dev, virt_to_page(offset),
> pay_off, len, DMA_TO_DEVICE);
> if (dma_mapping_error(device->dev, unmap->addr[0]))
> - goto err_get_unmap;
> + goto err_unmap;
>
> unmap->to_cnt = 1;
>
> unmap->addr[1] = dma_map_page(device->dev, virt_to_page(buf),
> buff_off, len, DMA_FROM_DEVICE);
> if (dma_mapping_error(device->dev, unmap->addr[1]))
> - goto err_get_unmap;
> + goto err_unmap;
>
> unmap->from_cnt = 1;
>
> @@ -1588,7 +1588,7 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
> unmap->addr[0], len,
> DMA_PREP_INTERRUPT);
> if (!txd)
> - goto err_get_unmap;
> + goto err_unmap;
>
> txd->callback_result = ntb_rx_copy_callback;
> txd->callback_param = entry;
> @@ -1596,7 +1596,7 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
>
> cookie = dmaengine_submit(txd);
> if (dma_submit_error(cookie))
> - goto err_set_unmap;
> + goto err_unmap;
>
> dmaengine_unmap_put(unmap);
>
> @@ -1606,9 +1606,7 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
>
> return 0;
>
> -err_set_unmap:
> - dmaengine_unmap_put(unmap);
> -err_get_unmap:
> +err_unmap:
> dmaengine_unmap_put(unmap);
> err:
> return -ENXIO;
> @@ -1854,14 +1852,14 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
> unmap->addr[0] = dma_map_page(device->dev, virt_to_page(buf),
> buff_off, len, DMA_TO_DEVICE);
> if (dma_mapping_error(device->dev, unmap->addr[0]))
> - goto err_get_unmap;
> + goto err_unmap;
>
> unmap->to_cnt = 1;
>
> txd = device->device_prep_dma_memcpy(chan, dest, unmap->addr[0], len,
> DMA_PREP_INTERRUPT);
> if (!txd)
> - goto err_get_unmap;
> + goto err_unmap;
>
> txd->callback_result = ntb_tx_copy_callback;
> txd->callback_param = entry;
> @@ -1869,16 +1867,14 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
>
> cookie = dmaengine_submit(txd);
> if (dma_submit_error(cookie))
> - goto err_set_unmap;
> + goto err_unmap;
>
> dmaengine_unmap_put(unmap);
>
> dma_async_issue_pending(chan);
>
> return 0;
> -err_set_unmap:
> - dmaengine_unmap_put(unmap);
> -err_get_unmap:
> +err_unmap:
> dmaengine_unmap_put(unmap);
> err:
> return -ENXIO;
next prev parent reply other threads:[~2025-11-03 17:45 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-03 17:23 [PATCH] NTB: ntb_transport: fix use after free Baruch Siach
2025-11-03 17:45 ` Dave Jiang [this message]
2025-11-04 0:32 ` Koichiro Den
2025-11-04 5:42 ` Baruch Siach
2025-11-06 3:59 ` Koichiro Den
2025-11-06 6:02 ` Baruch Siach
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=92ff3abf-fd15-44f1-ac18-7a6ea049197d@intel.com \
--to=dave.jiang@intel.com \
--cc=allenbh@gmail.com \
--cc=baruch@tkos.co.il \
--cc=den@valinux.co.jp \
--cc=jdmason@kudzu.us \
--cc=ntb@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox