Skip to contentSkip to conversation

NTB: ntb_transport: Ensure qp->tx_mw_dma_addr is initaliazed

PATCH In review Logan Gunthorpe 2 participants 2 messages Feb 19, 2019 – Mar 20, 2019 NTB driver core

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 NTB: ntb_transport: Ensure qp->tx_mw_dma_addr is initaliazed

Dan Carpenter's static checker reported:

    drivers/ntb/ntb_transport.c:1926 ntb_transport_create_queue()
    error: we previously assumed 'qp->tx_dma_chan' could be null (see line 1872)

This is because the tx_mw_dma_addr is uninitialized in this function and may be incorrectly released using a NULL DMA channel.

In practice this bug will not likely be seen. I'd guess you could hit this if you loaded ntb_netdev with use_dma=True, then unloaded it and loaded it again after setting the module parameter to use_dma=False.

To fix this, we simply ensure that tx_mw_dma_addr is always initialized to zero. This is the safest in case any other part of the code operates on it if it is non-zero.

Fixes c27ccb899219 ("NTB: ntb_transport: Ensure the destination buffer is mapped for TX DMA")
Cc Dan Carpenter <[email protected]>
Cc Jon Mason <[email protected]>
---
 drivers/ntb/ntb_transport.c | 1 +
 1 file changed, 1 insertion(+)

@Jon, it would be best if you can squash this with the commit that introduced the bug in ntb-next. Thanks.

drivers/ntb/ntb_transport.c +1 -0
index 526b65afc16a..e8a8304a42df 100644
@@ -1866,6 +1866,7 @@ ntb_transport_create_queue(void *data, struct device *client_dev,
 		qp->rx_dma_chan = NULL;
 	}
 
+	qp->tx_mw_dma_addr = 0;
 	if (qp->tx_dma_chan) {
 		qp->tx_mw_dma_addr =
 			dma_map_resource(qp->tx_dma_chan->device->dev,

--
2.19.0

maintainer
#1 lore raw
Quoted 12 lines · Logan Gunthorpe

Dan Carpenter's static checker reported:

    drivers/ntb/ntb_transport.c:1926 ntb_transport_create_queue()
    error: we previously assumed 'qp->tx_dma_chan' could be null (see line 1872)

This is because the tx_mw_dma_addr is uninitialized in this function and may be incorrectly released using a NULL DMA channel.

In practice this bug will not likely be seen. I'd guess you could hit this if you loaded ntb_netdev with use_dma=True, then unloaded it and loaded it again after setting the module parameter to use_dma=False.

Quoted 8 lines

To fix this, we simply ensure that tx_mw_dma_addr is always initialized to zero. This is the safest in case any other part of the code operates on it if it is non-zero.

Fixes c27ccb899219 ("NTB: ntb_transport: Ensure the destination buffer is mapped for TX DMA")
Cc Dan Carpenter <[email protected]>
Cc Jon Mason <[email protected]>

Included in the ntb branch.

Thanks,
Jon

Quoted 21 lines
---
 drivers/ntb/ntb_transport.c | 1 +
 1 file changed, 1 insertion(+)

@Jon, it would be best if you can squash this with the commit that introduced the bug in ntb-next. Thanks.

drivers/ntb/ntb_transport.c +1 -1
index 526b65afc16a..e8a8304a42df 100644
@@ -1866,6 +1866,7 @@ ntb_transport_create_queue(void *data, struct device *client_dev,
 		qp->rx_dma_chan = NULL;
 	}
 
+	qp->tx_mw_dma_addr = 0;
 	if (qp->tx_dma_chan) {
 		qp->tx_mw_dma_addr =
 			dma_map_resource(qp->tx_dma_chan->device->dev,
--

2.19.0