Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754690AbcCZTnA (ORCPT ); Sat, 26 Mar 2016 15:43:00 -0400 Received: from mail.ispras.ru ([83.149.199.45]:47811 "EHLO mail.ispras.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754264AbcCZTmw (ORCPT ); Sat, 26 Mar 2016 15:42:52 -0400 From: Alexey Khoroshilov To: Greg Kroah-Hartman , Vladimir Zapolskiy Cc: Alexey Khoroshilov , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: [PATCH v2] USB: whci-hcd: add more checks for dma mapping error Date: Sat, 26 Mar 2016 22:42:17 +0300 Message-Id: <1459021337-7025-1-git-send-email-khoroshilov@ispras.ru> X-Mailer: git-send-email 1.9.1 In-Reply-To: <56F5D5D0.8020505@mleia.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1946 Lines: 51 Fixing checks for dma mapping error in qset_fill_page_list(), I have missed two similar problems in qset_add_urb_sg() and in qset_add_urb_sg_linearize(). v2: check validity of dma_addr with dma_mapping_error() in qset_free_std() as suggested by Vladimir Zapolskiy. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov --- drivers/usb/host/whci/qset.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c index 1a8e960d073b..c0e6812426b3 100644 --- a/drivers/usb/host/whci/qset.c +++ b/drivers/usb/host/whci/qset.c @@ -314,7 +314,7 @@ void qset_free_std(struct whc *whc, struct whc_std *std) kfree(std->bounce_buf); } if (std->pl_virt) { - if (std->dma_addr) + if (!dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) dma_unmap_single(whc->wusbhc.dev, std->dma_addr, std->num_pointers * sizeof(struct whc_page_list_entry), DMA_TO_DEVICE); @@ -535,9 +535,11 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u list_for_each_entry(std, &qset->stds, list_node) { if (std->ntds_remaining == -1) { pl_len = std->num_pointers * sizeof(struct whc_page_list_entry); - std->ntds_remaining = ntds--; std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE); + if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) + return -EFAULT; + std->ntds_remaining = ntds--; } } return 0; @@ -618,6 +620,8 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset, std->dma_addr = dma_map_single(&whc->umc->dev, std->bounce_buf, std->len, is_out ? DMA_TO_DEVICE : DMA_FROM_DEVICE); + if (dma_mapping_error(&whc->umc->dev, std->dma_addr)) + return -EFAULT; if (qset_fill_page_list(whc, std, mem_flags) < 0) return -ENOMEM; -- 1.9.1