diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2016-03-26 22:42:17 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-04-19 04:33:15 +0900 |
| commit | e352506e8a871890278ba66a2d77167193ffbfa9 (patch) | |
| tree | 7a268664433f343eaf8eb9feb180bb8512548a9b /drivers/usb/host/whci | |
| parent | d4fc8bf59746b6ef9bdbec42a608b89d0221b7df (diff) | |
| download | linux-stable-e352506e8a871890278ba66a2d77167193ffbfa9.tar.gz linux-stable-e352506e8a871890278ba66a2d77167193ffbfa9.tar.bz2 linux-stable-e352506e8a871890278ba66a2d77167193ffbfa9.zip | |
USB: whci-hcd: add more checks for dma mapping error
Fixing checks for dma mapping error in qset_fill_page_list(),
I have missed two similar problems in qset_add_urb_sg() and
in qset_add_urb_sg_linearize().
v2: check validity of dma_addr with dma_mapping_error()
in qset_free_std() as suggested by Vladimir Zapolskiy.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/host/whci')
| -rw-r--r-- | drivers/usb/host/whci/qset.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c index 1a8e960d073b..c0e6812426b3 100644 --- a/drivers/usb/host/whci/qset.c +++ b/drivers/usb/host/whci/qset.c @@ -314,7 +314,7 @@ void qset_free_std(struct whc *whc, struct whc_std *std) kfree(std->bounce_buf); } if (std->pl_virt) { - if (std->dma_addr) + if (!dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) dma_unmap_single(whc->wusbhc.dev, std->dma_addr, std->num_pointers * sizeof(struct whc_page_list_entry), DMA_TO_DEVICE); @@ -535,9 +535,11 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u list_for_each_entry(std, &qset->stds, list_node) { if (std->ntds_remaining == -1) { pl_len = std->num_pointers * sizeof(struct whc_page_list_entry); - std->ntds_remaining = ntds--; std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE); + if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) + return -EFAULT; + std->ntds_remaining = ntds--; } } return 0; @@ -618,6 +620,8 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset, std->dma_addr = dma_map_single(&whc->umc->dev, std->bounce_buf, std->len, is_out ? DMA_TO_DEVICE : DMA_FROM_DEVICE); + if (dma_mapping_error(&whc->umc->dev, std->dma_addr)) + return -EFAULT; if (qset_fill_page_list(whc, std, mem_flags) < 0) return -ENOMEM; |