Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a9bbe53 authored by Ioana Radulescu's avatar Ioana Radulescu Committed by Greg Kroah-Hartman
Browse files

staging: fsl-dpaa2/eth: Fix incorrect kfree 



Use netdev_alloc_frag() instead of kmalloc to allocate space for
the S/G table of egress multi-buffer frames.

This fixes a bug where an unaligned pointer received from the
allocator would be overwritten with the 64B aligned value,
leading to a wrong address being later passed to kfree.

Signed-off-by: default avatarIoana Radulescu <ruxandra.radulescu@nxp.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bcb4f0d7

drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c

+6 −4
Original line number Diff line number Diff line
@@ -374,12 +374,14 @@ static int build_sg_fd(struct dpaa2_eth_priv *priv, 
	/* Prepare the HW SGT structure */

	sgt_buf_size = priv->tx_data_offset +

		       sizeof(struct dpaa2_sg_entry) * (1 + num_dma_bufs);

	sgt_buf = kzalloc(sgt_buf_size + DPAA2_ETH_TX_BUF_ALIGN, GFP_ATOMIC);

	sgt_buf = netdev_alloc_frag(sgt_buf_size + DPAA2_ETH_TX_BUF_ALIGN);

	if (unlikely(!sgt_buf)) {

		err = -ENOMEM;

		goto sgt_buf_alloc_failed;

	}

	sgt_buf = PTR_ALIGN(sgt_buf, DPAA2_ETH_TX_BUF_ALIGN);

	memset(sgt_buf, 0, sgt_buf_size);



	sgt = (struct dpaa2_sg_entry *)(sgt_buf + priv->tx_data_offset);



	/* Fill in the HW SGT structure.
@@ -421,7 +423,7 @@ static int build_sg_fd(struct dpaa2_eth_priv *priv, 
	return 0;



dma_map_single_failed:

	kfree(sgt_buf);

	skb_free_frag(sgt_buf);

sgt_buf_alloc_failed:

	dma_unmap_sg(dev, scl, num_sg, DMA_BIDIRECTIONAL);

dma_map_sg_failed:
@@ -525,9 +527,9 @@ static void free_tx_fd(const struct dpaa2_eth_priv *priv, 
		return;

	}



	/* Free SGT buffer kmalloc'ed on tx */

	/* Free SGT buffer allocated on tx */

	if (fd_format != dpaa2_fd_single)

		kfree(skbh);

		skb_free_frag(skbh);



	/* Move on with skb release */

	dev_kfree_skb(skb);