Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 128ed836 authored by Thomas Fourier's avatar Thomas Fourier Committed by Greg Kroah-Hartman
Browse files

et131x: Add missing check after DMA map 



[ Upstream commit d61f6cb6f6ef3c70d2ccc0d9c85c508cb8017da9 ]

The DMA map functions can fail and should be tested for errors.
If the mapping fails, unmap and return an error.

Signed-off-by: default avatarThomas Fourier <fourier.thomas@gmail.com>
Acked-by: default avatarMark Einon <mark.einon@gmail.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250716094733.28734-2-fourier.thomas@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 72dff025

drivers/net/ethernet/agere/et131x.c

+36 −0
Original line number Diff line number Diff line
@@ -2464,6 +2464,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) 
							  skb->data,

							  skb_headlen(skb),

							  DMA_TO_DEVICE);

				if (dma_mapping_error(&adapter->pdev->dev,

						      dma_addr))

					return -ENOMEM;



				desc[frag].addr_lo = lower_32_bits(dma_addr);

				desc[frag].addr_hi = upper_32_bits(dma_addr);

				frag++;
@@ -2473,6 +2477,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) 
							  skb->data,

							  skb_headlen(skb) / 2,

							  DMA_TO_DEVICE);

				if (dma_mapping_error(&adapter->pdev->dev,

						      dma_addr))

					return -ENOMEM;



				desc[frag].addr_lo = lower_32_bits(dma_addr);

				desc[frag].addr_hi = upper_32_bits(dma_addr);

				frag++;
@@ -2483,6 +2491,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) 
							  skb_headlen(skb) / 2,

							  skb_headlen(skb) / 2,

							  DMA_TO_DEVICE);

				if (dma_mapping_error(&adapter->pdev->dev,

						      dma_addr))

					goto unmap_first_out;



				desc[frag].addr_lo = lower_32_bits(dma_addr);

				desc[frag].addr_hi = upper_32_bits(dma_addr);

				frag++;
@@ -2494,6 +2506,9 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) 
						    0,

						    desc[frag].len_vlan,

						    DMA_TO_DEVICE);

			if (dma_mapping_error(&adapter->pdev->dev, dma_addr))

				goto unmap_out;



			desc[frag].addr_lo = lower_32_bits(dma_addr);

			desc[frag].addr_hi = upper_32_bits(dma_addr);

			frag++;
@@ -2583,6 +2598,27 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) 
		       &adapter->regs->global.watchdog_timer);

	}

	return 0;



unmap_out:

	// Unmap the body of the packet with map_page

	while (--i) {

		frag--;

		dma_addr = desc[frag].addr_lo;

		dma_addr |= (u64)desc[frag].addr_hi << 32;

		dma_unmap_page(&adapter->pdev->dev, dma_addr,

			       desc[frag].len_vlan, DMA_TO_DEVICE);

	}



unmap_first_out:

	// Unmap the header with map_single

	while (frag--) {

		dma_addr = desc[frag].addr_lo;

		dma_addr |= (u64)desc[frag].addr_hi << 32;

		dma_unmap_single(&adapter->pdev->dev, dma_addr,

				 desc[frag].len_vlan, DMA_TO_DEVICE);

	}



	return -ENOMEM;

}



static int send_packet(struct sk_buff *skb, struct et131x_adapter *adapter)