Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752082AbdHGVGn (ORCPT ); Mon, 7 Aug 2017 17:06:43 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:36104 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751860AbdHGVGl (ORCPT ); Mon, 7 Aug 2017 17:06:41 -0400 Date: Mon, 07 Aug 2017 14:06:40 -0700 (PDT) Message-Id: <20170807.140640.71936308742422582.davem@davemloft.net> To: khoroshilov@ispras.ru Cc: romieu@fr.zoreil.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: Re: [PATCH] wan: dscc4: add checks for dma mapping errors From: David Miller In-Reply-To: <1501878204-24270-1-git-send-email-khoroshilov@ispras.ru> References: <1501878204-24270-1-git-send-email-khoroshilov@ispras.ru> X-Mailer: Mew version 6.7 on Emacs 25.2 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 07 Aug 2017 14:06:40 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1004 Lines: 33 From: Alexey Khoroshilov Date: Fri, 4 Aug 2017 23:23:24 +0300 > The driver does not check if mapping dma memory succeed. > The patch adds the checks and failure handling. > > Found by Linux Driver Verification project (linuxtesting.org). > > Signed-off-by: Alexey Khoroshilov This is a great example of why it can be irritating to see these mechanical "bug fixes" for drivers very few people use and actually test, which introduces new bugs. > @@ -522,19 +522,27 @@ static inline int try_get_rx_skb(struct dscc4_dev_priv *dpriv, > struct RxFD *rx_fd = dpriv->rx_fd + dirty; > const int len = RX_MAX(HDLC_MAX_MRU); > struct sk_buff *skb; > - int ret = 0; > + dma_addr_t addr; > > skb = dev_alloc_skb(len); > dpriv->rx_skbuff[dirty] = skb; skb recorded here. > +err_free_skb: > + dev_kfree_skb_any(skb); Yet freed here in the error path. dpriv->rx_skbuff[dirty] should not be set to 'skb' until all possibile failure tests have passed.