From patchwork Sat Oct 7 11:13:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe JAILLET X-Patchwork-Id: 13412270 Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2DF3168D0 for ; Sat, 7 Oct 2023 11:13:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=wanadoo.fr header.i=@wanadoo.fr header.b="Bz4ajFDC" Received: from smtp.smtpout.orange.fr (smtp-16.smtpout.orange.fr [80.12.242.16]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7E469E for ; Sat, 7 Oct 2023 04:13:27 -0700 (PDT) Received: from pop-os.home ([86.243.2.178]) by smtp.orange.fr with ESMTPA id p5FLqUFvtkkaep5FLqw9nt; Sat, 07 Oct 2023 13:13:25 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wanadoo.fr; s=t20230301; t=1696677205; bh=jCnIoIQF1DC9kwrL6dXuT211TCz3UEY3JUvXyvj4/xA=; h=From:To:Cc:Subject:Date; b=Bz4ajFDCdsu6VLEUWlJxz+ijo79EHIaWdKaD8IFozP5GoVggXqYNJurHxg9jfLDrm Px3gKMs4reBgrw6vI2PGmDIUUEJTMEU/33Otfpt8Q8W1BsWAc8kmio886Bcr8WFN29 0/3QG1V7ul7xji93lwONquEqbdiH+v2y7VyXAvP9+1W+o5NtIQXs/Yo+ECEpBr3lIX GiIMQYJ5FtVCsxRdNqzNa/BKr+6T4R/0dM8YrUbhuQRc2KF9in/qpXgLrctRJuN0MH zNij+/NOZS8GuDWL5wna3C6W5BTagVUXYMSa6jAPiSvBMt7kzmyEh5dmS56BUgu/rt Nbz/n1XTUwl3Q== X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sat, 07 Oct 2023 13:13:25 +0200 X-ME-IP: 86.243.2.178 From: Christophe JAILLET To: keescook@chromium.org, gustavoars@kernel.org, Daniel Mack , Haojian Zhuang , Robert Jarzmik , Vinod Koul Cc: linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-arm-kernel@lists.infradead.org, dmaengine@vger.kernel.org Subject: [PATCH 1/2] dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() Date: Sat, 7 Oct 2023 13:13:09 +0200 Message-Id: X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net If pxad_alloc_desc() fails on the first dma_pool_alloc() call, then sw_desc->nb_desc is zero. In such a case pxad_free_desc() is called and it will BUG_ON(). Remove this erroneous BUG_ON(). It is also useless, because if "sw_desc->nb_desc == 0", then, on the first iteration of the for loop, i is -1 and the loop will not be executed. (both i and sw_desc->nb_desc are 'int') Fixes: a57e16cf0333 ("dmaengine: pxa: add pxa dmaengine driver") Signed-off-by: Christophe JAILLET --- drivers/dma/pxa_dma.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index 3c574dc0613b..94cef2905940 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -722,7 +722,6 @@ static void pxad_free_desc(struct virt_dma_desc *vd) dma_addr_t dma; struct pxad_desc_sw *sw_desc = to_pxad_sw_desc(vd); - BUG_ON(sw_desc->nb_desc == 0); for (i = sw_desc->nb_desc - 1; i >= 0; i--) { if (i > 0) dma = sw_desc->hw_desc[i - 1]->ddadr; From patchwork Sat Oct 7 11:13:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe JAILLET X-Patchwork-Id: 13412271 Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D5171802D for ; Sat, 7 Oct 2023 11:13:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=wanadoo.fr header.i=@wanadoo.fr header.b="pa0Ht/+k" Received: from smtp.smtpout.orange.fr (smtp-16.smtpout.orange.fr [80.12.242.16]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 730A7AB for ; Sat, 7 Oct 2023 04:13:29 -0700 (PDT) Received: from pop-os.home ([86.243.2.178]) by smtp.orange.fr with ESMTPA id p5FLqUFvtkkaep5FPqw9oL; Sat, 07 Oct 2023 13:13:28 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wanadoo.fr; s=t20230301; t=1696677208; bh=SyXlzkufD32ONJRqEUudpUaKb11ktLKN0H131JCB37s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pa0Ht/+kirGb8FefDOjnr78UXIM/jKWvkUJW1HqJ1jqV7PCngyX3to4Qwqebkgm9K 3keqCckP+l0pg1CZP9QpPxdvHMzp3RoDABNokHmtkj1SUaK2ZyKJV7/oknFCxppc46 kzzfVDxSvYGwDoTWHYd54DNXfyDKjuC3mPB6jbK2jKFqomJRipzuC2iwChQczE8MxN YyBDLqCvyKmJQv9dQjlhwHIzLY2vGzlmlUh2waj4iT8JTurRZuc5uvUMuLi14Jki8C rfo7eAe+o2iy++uI6XfvE26dIt5fRBM1g1p6lAkk2tGCrKpszW9ummZdTZliNSyY2N ff9FzmYcnxY8w== X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sat, 07 Oct 2023 13:13:28 +0200 X-ME-IP: 86.243.2.178 From: Christophe JAILLET To: keescook@chromium.org, gustavoars@kernel.org, Daniel Mack , Haojian Zhuang , Robert Jarzmik , Vinod Koul , Nathan Chancellor , Nick Desaulniers , Tom Rix Cc: linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-arm-kernel@lists.infradead.org, dmaengine@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH 2/2] dmaengine: pxa_dma: Annotate struct pxad_desc_sw with __counted_by Date: Sat, 7 Oct 2023 13:13:10 +0200 Message-Id: <1c9ef22826f449a3756bb13a83494e9fe3e0be8b.1696676782.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). To do so, the code needs a little shuffling related to how hw_desc is used and nb_desc incremented. The one by one increment is needed for the error handling path, calling pxad_free_desc(), to work correctly. So, add a new intermediate variable, desc, to store the result of the dma_pool_alloc() call. Signed-off-by: Christophe JAILLET Reviewed-by: Kees Cook --- This patch is part of a work done in parallel of what is currently worked on by Kees Cook. My patches are only related to corner cases that do NOT match the semantic of his Coccinelle script[1]. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci --- drivers/dma/pxa_dma.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index 94cef2905940..c6e2862896e3 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -91,7 +91,8 @@ struct pxad_desc_sw { bool cyclic; struct dma_pool *desc_pool; /* Channel's used allocator */ - struct pxad_desc_hw *hw_desc[]; /* DMA coherent descriptors */ + struct pxad_desc_hw *hw_desc[] __counted_by(nb_desc); + /* DMA coherent descriptors */ }; struct pxad_phy { @@ -739,6 +740,7 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int nb_hw_desc) { struct pxad_desc_sw *sw_desc; dma_addr_t dma; + void *desc; int i; sw_desc = kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), @@ -748,20 +750,21 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int nb_hw_desc) sw_desc->desc_pool = chan->desc_pool; for (i = 0; i < nb_hw_desc; i++) { - sw_desc->hw_desc[i] = dma_pool_alloc(sw_desc->desc_pool, - GFP_NOWAIT, &dma); - if (!sw_desc->hw_desc[i]) { + desc = dma_pool_alloc(sw_desc->desc_pool, GFP_NOWAIT, &dma); + if (!desc) { dev_err(&chan->vc.chan.dev->device, "%s(): Couldn't allocate the %dth hw_desc from dma_pool %p\n", __func__, i, sw_desc->desc_pool); goto err; } + sw_desc->nb_desc++; + sw_desc->hw_desc[i] = desc; + if (i == 0) sw_desc->first = dma; else sw_desc->hw_desc[i - 1]->ddadr = dma; - sw_desc->nb_desc++; } return sw_desc;