On Wed, Apr 04, 2018 at 04:24:10PM +0900, Ji-Hun Kim wrote:
> > Since we only partially allocated the
> > rd0 ring, device_free_rd0_ring() will crash when we do:
> >
> > dma_unmap_single(>pcid->dev, rd_info->skb_dma,
> > priv->rx_buf_sz, DMA_FROM_DEVICE);
On Wed, Apr 04, 2018 at 04:24:10PM +0900, Ji-Hun Kim wrote:
> > Since we only partially allocated the
> > rd0 ring, device_free_rd0_ring() will crash when we do:
> >
> > dma_unmap_single(>pcid->dev, rd_info->skb_dma,
> > priv->rx_buf_sz, DMA_FROM_DEVICE);
On Tue, Apr 03, 2018 at 01:40:52PM +0300, Dan Carpenter wrote:
> > desc->rd_info = kzalloc(sizeof(*desc->rd_info), GFP_KERNEL);
> > -
> > + if (!desc->rd_info) {
> > + ret = -ENOMEM;
> > + goto error;
> > + }
> > if
On Tue, Apr 03, 2018 at 01:40:52PM +0300, Dan Carpenter wrote:
> > desc->rd_info = kzalloc(sizeof(*desc->rd_info), GFP_KERNEL);
> > -
> > + if (!desc->rd_info) {
> > + ret = -ENOMEM;
> > + goto error;
> > + }
> > if
On Fri, Mar 30, 2018 at 11:44:04AM +0900, Ji-Hun Kim wrote:
> @@ -528,18 +528,22 @@ static void device_free_rings(struct vnt_private *priv)
> priv->tx0_bufs, priv->tx_bufs_dma0);
> }
>
> -static void device_init_rd0_ring(struct vnt_private *priv)
> +static int
On Fri, Mar 30, 2018 at 11:44:04AM +0900, Ji-Hun Kim wrote:
> @@ -528,18 +528,22 @@ static void device_free_rings(struct vnt_private *priv)
> priv->tx0_bufs, priv->tx_bufs_dma0);
> }
>
> -static void device_init_rd0_ring(struct vnt_private *priv)
> +static int
On 2018/3/30 11:39, Ji-Hun Kim wrote:
On Fri, Mar 30, 2018 at 11:15:03AM +0800, Jia-Ju Bai wrote:
On 2018/3/30 10:44, Ji-Hun Kim wrote:
@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
}
dev_dbg(>pcid->dev, "call device init rd0 ring\n");
-
On 2018/3/30 11:39, Ji-Hun Kim wrote:
On Fri, Mar 30, 2018 at 11:15:03AM +0800, Jia-Ju Bai wrote:
On 2018/3/30 10:44, Ji-Hun Kim wrote:
@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
}
dev_dbg(>pcid->dev, "call device init rd0 ring\n");
-
On Fri, Mar 30, 2018 at 11:15:03AM +0800, Jia-Ju Bai wrote:
>
>
> On 2018/3/30 10:44, Ji-Hun Kim wrote:
> >@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
> > }
> > dev_dbg(>pcid->dev, "call device init rd0 ring\n");
> >-device_init_rd0_ring(priv);
> >-
On Fri, Mar 30, 2018 at 11:15:03AM +0800, Jia-Ju Bai wrote:
>
>
> On 2018/3/30 10:44, Ji-Hun Kim wrote:
> >@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
> > }
> > dev_dbg(>pcid->dev, "call device init rd0 ring\n");
> >-device_init_rd0_ring(priv);
> >-
On Fri, Mar 30, 2018 at 11:15:03AM +0800, Jia-Ju Bai wrote:
>
>
> On 2018/3/30 10:44, Ji-Hun Kim wrote:
> >@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
> > }
> > dev_dbg(>pcid->dev, "call device init rd0 ring\n");
> >-device_init_rd0_ring(priv);
> >-
On Fri, Mar 30, 2018 at 11:15:03AM +0800, Jia-Ju Bai wrote:
>
>
> On 2018/3/30 10:44, Ji-Hun Kim wrote:
> >@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
> > }
> > dev_dbg(>pcid->dev, "call device init rd0 ring\n");
> >-device_init_rd0_ring(priv);
> >-
On 2018/3/30 10:44, Ji-Hun Kim wrote:
@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
}
dev_dbg(>pcid->dev, "call device init rd0 ring\n");
- device_init_rd0_ring(priv);
- device_init_rd1_ring(priv);
- device_init_td0_ring(priv);
-
On 2018/3/30 10:44, Ji-Hun Kim wrote:
@@ -1165,10 +1205,18 @@ static int vnt_start(struct ieee80211_hw *hw)
}
dev_dbg(>pcid->dev, "call device init rd0 ring\n");
- device_init_rd0_ring(priv);
- device_init_rd1_ring(priv);
- device_init_td0_ring(priv);
-
There are no null pointer checking on rd_info and td_info values which
are allocated by kzalloc. It has potential null pointer dereferencing
issues. Implement error handling code on device_init_rd*, device_init_td*
and vnt_start for the allocation failures.
Signed-off-by: Ji-Hun Kim
There are no null pointer checking on rd_info and td_info values which
are allocated by kzalloc. It has potential null pointer dereferencing
issues. Implement error handling code on device_init_rd*, device_init_td*
and vnt_start for the allocation failures.
Signed-off-by: Ji-Hun Kim
---
Changes
16 matches
Mail list logo