From patchwork Sat Oct 7 11:13:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe JAILLET X-Patchwork-Id: 13412272 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2C109E95A61 for ; Sat, 7 Oct 2023 11:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=z+JuaHB+tZggIl99RIrDT8CJH3glx9Xs84ckXEunqYk=; b=bfVmjwBIfp53zX gxIqj0R7AoaxuTPAJE+un7vjJqpN8PWEfJTn+2GwTQgyLxmdwY8zEjWRpmWyi0I0iPXmOUOoDrSuE /3RgiIilOIy/UwACKML8B4irumPQvKrWvx7jvEEmkMfla8Fl3VtsMkDoEhoWy+74Ftmt1eALiJYpA IjS/O9ggHrBg6FdHvV4ORuwsLdVE2df4Fs/XBmIz6/DPC9wgCjNK78RSlMNrQWqWz9PBeRi6UmT7X xWp2UT43wQJjpYAdeYPo6GduJo3IXP4Hho+WWKRJiru1oNZw3IZDEEMe6rbtM1CQPikWshHpv8hxW g5ru62HqLMoNwLAx0g1A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qp5Fb-007ULz-0Z; Sat, 07 Oct 2023 11:13:39 +0000 Received: from smtp-15.smtpout.orange.fr ([80.12.242.15] helo=smtp.smtpout.orange.fr) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qp5FW-007UJr-2W for linux-arm-kernel@lists.infradead.org; Sat, 07 Oct 2023 11:13:36 +0000 Received: from pop-os.home ([86.243.2.178]) by smtp.orange.fr with ESMTPA id p5FLqUFvtkkaep5FLqw9nt; Sat, 07 Oct 2023 13:13:25 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wanadoo.fr; s=t20230301; t=1696677205; bh=jCnIoIQF1DC9kwrL6dXuT211TCz3UEY3JUvXyvj4/xA=; h=From:To:Cc:Subject:Date; b=Bz4ajFDCdsu6VLEUWlJxz+ijo79EHIaWdKaD8IFozP5GoVggXqYNJurHxg9jfLDrm Px3gKMs4reBgrw6vI2PGmDIUUEJTMEU/33Otfpt8Q8W1BsWAc8kmio886Bcr8WFN29 0/3QG1V7ul7xji93lwONquEqbdiH+v2y7VyXAvP9+1W+o5NtIQXs/Yo+ECEpBr3lIX GiIMQYJ5FtVCsxRdNqzNa/BKr+6T4R/0dM8YrUbhuQRc2KF9in/qpXgLrctRJuN0MH zNij+/NOZS8GuDWL5wna3C6W5BTagVUXYMSa6jAPiSvBMt7kzmyEh5dmS56BUgu/rt Nbz/n1XTUwl3Q== X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sat, 07 Oct 2023 13:13:25 +0200 X-ME-IP: 86.243.2.178 From: Christophe JAILLET To: keescook@chromium.org, gustavoars@kernel.org, Daniel Mack , Haojian Zhuang , Robert Jarzmik , Vinod Koul Cc: linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-arm-kernel@lists.infradead.org, dmaengine@vger.kernel.org Subject: [PATCH 1/2] dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() Date: Sat, 7 Oct 2023 13:13:09 +0200 Message-Id: X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231007_041334_987317_2D125418 X-CRM114-Status: GOOD ( 10.20 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org If pxad_alloc_desc() fails on the first dma_pool_alloc() call, then sw_desc->nb_desc is zero. In such a case pxad_free_desc() is called and it will BUG_ON(). Remove this erroneous BUG_ON(). It is also useless, because if "sw_desc->nb_desc == 0", then, on the first iteration of the for loop, i is -1 and the loop will not be executed. (both i and sw_desc->nb_desc are 'int') Fixes: a57e16cf0333 ("dmaengine: pxa: add pxa dmaengine driver") Signed-off-by: Christophe JAILLET --- drivers/dma/pxa_dma.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index 3c574dc0613b..94cef2905940 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -722,7 +722,6 @@ static void pxad_free_desc(struct virt_dma_desc *vd) dma_addr_t dma; struct pxad_desc_sw *sw_desc = to_pxad_sw_desc(vd); - BUG_ON(sw_desc->nb_desc == 0); for (i = sw_desc->nb_desc - 1; i >= 0; i--) { if (i > 0) dma = sw_desc->hw_desc[i - 1]->ddadr; From patchwork Sat Oct 7 11:13:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe JAILLET X-Patchwork-Id: 13412273 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 547C8E95A60 for ; Sat, 7 Oct 2023 11:14:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=6kyet2+XE/6+rZjDt8IP5cknsUjne5T8jXaIV/aTfx8=; b=ZFFQddh+3soB35 1RTxGHh/NyIXAE6SkZacDXMuy3mQIn31YJ3cjWxiOf0C93FDHrQ1EH41yPl1YykeOxJekf2G70Nzx cSdMHTyslLdSP8S/cKGRN+pEPGVr95lZJGdlF7gfZIYRpC6E3Pam7EdMmA6WHUjnZgWO8OKaTi4iV VXw/iyfcjBMN9rZaHkmZQMgbfycErT2T58gVfMRraTBvPMSf6icS8VyhpoUUDwc7QBvSdn3oPO2nG EYGiOCXaja4KagWbHhxIbMmmdAx7N16YrEwhEEtANbiRyTH/anZi7MhyUtX7noT5SVcymqTvxeSQm dCzpLO9OCpGcNmkpYYZg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qp5Fb-007UM5-2B; Sat, 07 Oct 2023 11:13:39 +0000 Received: from smtp-16.smtpout.orange.fr ([80.12.242.16] helo=smtp.smtpout.orange.fr) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qp5FW-007UJt-2W for linux-arm-kernel@lists.infradead.org; Sat, 07 Oct 2023 11:13:37 +0000 Received: from pop-os.home ([86.243.2.178]) by smtp.orange.fr with ESMTPA id p5FLqUFvtkkaep5FPqw9oL; Sat, 07 Oct 2023 13:13:28 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wanadoo.fr; s=t20230301; t=1696677208; bh=SyXlzkufD32ONJRqEUudpUaKb11ktLKN0H131JCB37s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pa0Ht/+kirGb8FefDOjnr78UXIM/jKWvkUJW1HqJ1jqV7PCngyX3to4Qwqebkgm9K 3keqCckP+l0pg1CZP9QpPxdvHMzp3RoDABNokHmtkj1SUaK2ZyKJV7/oknFCxppc46 kzzfVDxSvYGwDoTWHYd54DNXfyDKjuC3mPB6jbK2jKFqomJRipzuC2iwChQczE8MxN YyBDLqCvyKmJQv9dQjlhwHIzLY2vGzlmlUh2waj4iT8JTurRZuc5uvUMuLi14Jki8C rfo7eAe+o2iy++uI6XfvE26dIt5fRBM1g1p6lAkk2tGCrKpszW9ummZdTZliNSyY2N ff9FzmYcnxY8w== X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sat, 07 Oct 2023 13:13:28 +0200 X-ME-IP: 86.243.2.178 From: Christophe JAILLET To: keescook@chromium.org, gustavoars@kernel.org, Daniel Mack , Haojian Zhuang , Robert Jarzmik , Vinod Koul , Nathan Chancellor , Nick Desaulniers , Tom Rix Cc: linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-arm-kernel@lists.infradead.org, dmaengine@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH 2/2] dmaengine: pxa_dma: Annotate struct pxad_desc_sw with __counted_by Date: Sat, 7 Oct 2023 13:13:10 +0200 Message-Id: <1c9ef22826f449a3756bb13a83494e9fe3e0be8b.1696676782.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231007_041334_987501_2C2576AC X-CRM114-Status: GOOD ( 15.89 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). To do so, the code needs a little shuffling related to how hw_desc is used and nb_desc incremented. The one by one increment is needed for the error handling path, calling pxad_free_desc(), to work correctly. So, add a new intermediate variable, desc, to store the result of the dma_pool_alloc() call. Signed-off-by: Christophe JAILLET Reviewed-by: Kees Cook --- This patch is part of a work done in parallel of what is currently worked on by Kees Cook. My patches are only related to corner cases that do NOT match the semantic of his Coccinelle script[1]. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci --- drivers/dma/pxa_dma.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index 94cef2905940..c6e2862896e3 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -91,7 +91,8 @@ struct pxad_desc_sw { bool cyclic; struct dma_pool *desc_pool; /* Channel's used allocator */ - struct pxad_desc_hw *hw_desc[]; /* DMA coherent descriptors */ + struct pxad_desc_hw *hw_desc[] __counted_by(nb_desc); + /* DMA coherent descriptors */ }; struct pxad_phy { @@ -739,6 +740,7 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int nb_hw_desc) { struct pxad_desc_sw *sw_desc; dma_addr_t dma; + void *desc; int i; sw_desc = kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), @@ -748,20 +750,21 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int nb_hw_desc) sw_desc->desc_pool = chan->desc_pool; for (i = 0; i < nb_hw_desc; i++) { - sw_desc->hw_desc[i] = dma_pool_alloc(sw_desc->desc_pool, - GFP_NOWAIT, &dma); - if (!sw_desc->hw_desc[i]) { + desc = dma_pool_alloc(sw_desc->desc_pool, GFP_NOWAIT, &dma); + if (!desc) { dev_err(&chan->vc.chan.dev->device, "%s(): Couldn't allocate the %dth hw_desc from dma_pool %p\n", __func__, i, sw_desc->desc_pool); goto err; } + sw_desc->nb_desc++; + sw_desc->hw_desc[i] = desc; + if (i == 0) sw_desc->first = dma; else sw_desc->hw_desc[i - 1]->ddadr = dma; - sw_desc->nb_desc++; } return sw_desc;