Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754486AbcCYWDN (ORCPT ); Fri, 25 Mar 2016 18:03:13 -0400 Received: from mleia.com ([178.79.152.223]:34406 "EHLO mail.mleia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754339AbcCYWDM (ORCPT ); Fri, 25 Mar 2016 18:03:12 -0400 Subject: Re: [PATCH] USB: whci-hcd: add more checks for dma mapping error To: Alexey Khoroshilov , Greg Kroah-Hartman References: <1458937421-18120-1-git-send-email-khoroshilov@ispras.ru> Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org From: Vladimir Zapolskiy Message-ID: <56F5B59C.3050001@mleia.com> Date: Sat, 26 Mar 2016 00:03:08 +0200 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Icedove/38.5.0 MIME-Version: 1.0 In-Reply-To: <1458937421-18120-1-git-send-email-khoroshilov@ispras.ru> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-49551924 X-CRM114-CacheID: sfid-20160325_220725_658632_1B2E293C X-CRM114-Status: GOOD ( 18.90 ) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1789 Lines: 49 On 25.03.2016 22:23, Alexey Khoroshilov wrote: > Fixing checks for dma mapping error in qset_fill_page_list(), > I have missed two similar problems in qset_add_urb_sg() and > in qset_add_urb_sg_linearize(). > > Found by Linux Driver Verification project (linuxtesting.org). > > Signed-off-by: Alexey Khoroshilov > --- > drivers/usb/host/whci/qset.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c > index 1a8e960d073b..a8e9b618e643 100644 > --- a/drivers/usb/host/whci/qset.c > +++ b/drivers/usb/host/whci/qset.c > @@ -535,9 +535,11 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u > list_for_each_entry(std, &qset->stds, list_node) { > if (std->ntds_remaining == -1) { > pl_len = std->num_pointers * sizeof(struct whc_page_list_entry); > - std->ntds_remaining = ntds--; > std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, > pl_len, DMA_TO_DEVICE); > + if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) > + return -EFAULT; Resources are leaked on error path: * std->pl_virt -- most probably, at least it is freed on error path above, * dma mappings done in a loop before met error, > + std->ntds_remaining = ntds--; > } > } > return 0; > @@ -618,6 +620,8 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset, > > std->dma_addr = dma_map_single(&whc->umc->dev, std->bounce_buf, std->len, > is_out ? DMA_TO_DEVICE : DMA_FROM_DEVICE); > + if (dma_mapping_error(&whc->umc->dev, std->dma_addr)) > + return -EFAULT; > > if (qset_fill_page_list(whc, std, mem_flags) < 0) > return -ENOMEM; > -- With best wishes, Vladimir