Received: by 10.213.65.68 with SMTP id h4csp466925imn; Tue, 13 Mar 2018 09:58:44 -0700 (PDT) X-Google-Smtp-Source: AG47ELuaKOLft8mEUSIAkLTdwv5r5ESqaQsOAC3XS1ELaaClkIrbXU3OpF+UZHNwbJ7KZ4L+lDVK X-Received: by 10.101.97.139 with SMTP id c11mr1038323pgv.447.1520960324200; Tue, 13 Mar 2018 09:58:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1520960324; cv=none; d=google.com; s=arc-20160816; b=o848vcu5SEU5FoZr5Qdq5onvR8lgHxv3J2Lic9X46JjiIi1Zo6a6nmiiWugdw2j2DZ wO01xzcbQweYI0h/JEaDJ0PofMoZ7QAYV0cbhC9fEi/yH67Z7b1KUUpZ0B4YkkBZM2oz CiM6dzb2+ckeY/Gc3MAmnsH3JkJ4+MrptkMMbmbkaIj+i3wy8IeqUpKHXeM921Vhn9rD nqv8F1g6V05xq13tPecx+OjnR/nQRxKZZ/rpxVsIUtWJl+svrcskJkH81ElLg/jjBXLR kKuJUKjKxXhsEjej4JzeDjwZsfkvucsZP32Lx2H6t0xBrQzxqjhTi3Fx2Cbt6d4IJfDs payg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:date:subject:cc :to:from:arc-authentication-results; bh=P2Sc4ZGV/+QhrOy568RY+EmRYTKiATHoD/l65BD9A4A=; b=TbkQbdCnuHu20Jz2x/zHH56+nREYnmMLeKhYZ9iwFMnS0+bghJU+RrmygXs3wXBSLO tfNBL0OdzALyDZzEkWkPecGUlu8TVKkVNztlTyb+aMYSCIoZRrfs4miYuVKOYSHA4oBv 1CV5GPnwa38Yh6u6Yy3DO8FJ1pnC+bKIVz4yMgISytWq5QUQViuln4nWzxyLBKyKkS5g 509FzQeO6GQQjz0WJ8bgQuEb+HVmTTsfxmqwyBT+SO0EM1wuETXui2ZtxN2/yKYaKHGK m9B+0zYrx5bxU/TxI27d66VX2Sg67SCHuM37oCTFLuIVqhM4T+v/qbQiYWVmOf7miL/7 aX8A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b3si257000pga.503.2018.03.13.09.58.29; Tue, 13 Mar 2018 09:58:44 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933464AbeCMQz5 (ORCPT + 99 others); Tue, 13 Mar 2018 12:55:57 -0400 Received: from mx08-00178001.pphosted.com ([91.207.212.93]:60862 "EHLO mx07-00178001.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752163AbeCMQzz (ORCPT ); Tue, 13 Mar 2018 12:55:55 -0400 Received: from pps.filterd (m0046661.ppops.net [127.0.0.1]) by mx08-.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id w2DGn8dv006808; Tue, 13 Mar 2018 17:55:37 +0100 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx08-00178001.pphosted.com with ESMTP id 2gpc6wa3jt-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 13 Mar 2018 17:55:37 +0100 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id A273431; Tue, 13 Mar 2018 16:55:36 +0000 (GMT) Received: from Webmail-eu.st.com (sfhdag5node2.st.com [10.75.127.14]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 7ACB5A6E2; Tue, 13 Mar 2018 16:55:36 +0000 (GMT) Received: from localhost (10.75.127.47) by SFHDAG5NODE2.st.com (10.75.127.14) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Tue, 13 Mar 2018 17:55:35 +0100 From: Pierre-Yves MORDRET To: Vinod Koul , Maxime Coquelin , Alexandre Torgue , Dan Williams , "M'boumba Cedric Madianga" , , , CC: Pierre-Yves MORDRET Subject: [PATCH v1 1/1] dmaengine: stm32-dmamux: fix a potential buffer overflow Date: Tue, 13 Mar 2018 17:55:35 +0100 Message-ID: <1520960135-26575-1-git-send-email-pierre-yves.mordret@st.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.75.127.47] X-ClientProxiedBy: SFHDAG8NODE2.st.com (10.75.127.23) To SFHDAG5NODE2.st.com (10.75.127.14) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-13_07:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The bitfield dma_inuse is allocated of size dma_requests bits, thus a valid bit address is from 0 to (dma_requests - 1). When find_first_zero_bit() fails, it returns dma_requests as invalid address. Using such address for the following set_bit() is incorrect and, if dma_requests is a multiple of BITS_PER_LONG, it will cause a buffer overflow. Currently this driver is only used in DT stm32h743.dtsi where a safe value dma_requests=16 is not triggering the buffer overflow. Fixed by checking the return value of find_first_zero_bit() _before_ using it. Signed-off-by: Antonio Borneo Signed-off-by: Pierre-Yves MORDRET --- Version history: v1: * Initial --- --- drivers/dma/stm32-dmamux.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c index 4dbb30c..b922db9 100644 --- a/drivers/dma/stm32-dmamux.c +++ b/drivers/dma/stm32-dmamux.c @@ -118,14 +118,15 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, spin_lock_irqsave(&dmamux->lock, flags); mux->chan_id = find_first_zero_bit(dmamux->dma_inuse, dmamux->dma_requests); - set_bit(mux->chan_id, dmamux->dma_inuse); - spin_unlock_irqrestore(&dmamux->lock, flags); if (mux->chan_id == dmamux->dma_requests) { + spin_unlock_irqrestore(&dmamux->lock, flags); dev_err(&pdev->dev, "Run out of free DMA requests\n"); ret = -ENOMEM; - goto error; + goto error_chan_id; } + set_bit(mux->chan_id, dmamux->dma_inuse); + spin_unlock_irqrestore(&dmamux->lock, flags); /* Look for DMA Master */ for (i = 1, min = 0, max = dmamux->dma_reqs[i]; @@ -173,6 +174,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, error: clear_bit(mux->chan_id, dmamux->dma_inuse); + +error_chan_id: kfree(mux); return ERR_PTR(ret); } -- 2.7.4