mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
staging: fsl-dpaa2/eth: Fix incorrect kfree
Use netdev_alloc_frag() instead of kmalloc to allocate space for the S/G table of egress multi-buffer frames. This fixes a bug where an unaligned pointer received from the allocator would be overwritten with the 64B aligned value, leading to a wrong address being later passed to kfree. Signed-off-by: Ioana Radulescu <ruxandra.radulescu@nxp.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bcb4f0d75b
commit
6a9bbe53db
1 changed files with 6 additions and 4 deletions
|
@ -374,12 +374,14 @@ static int build_sg_fd(struct dpaa2_eth_priv *priv,
|
|||
/* Prepare the HW SGT structure */
|
||||
sgt_buf_size = priv->tx_data_offset +
|
||||
sizeof(struct dpaa2_sg_entry) * (1 + num_dma_bufs);
|
||||
sgt_buf = kzalloc(sgt_buf_size + DPAA2_ETH_TX_BUF_ALIGN, GFP_ATOMIC);
|
||||
sgt_buf = netdev_alloc_frag(sgt_buf_size + DPAA2_ETH_TX_BUF_ALIGN);
|
||||
if (unlikely(!sgt_buf)) {
|
||||
err = -ENOMEM;
|
||||
goto sgt_buf_alloc_failed;
|
||||
}
|
||||
sgt_buf = PTR_ALIGN(sgt_buf, DPAA2_ETH_TX_BUF_ALIGN);
|
||||
memset(sgt_buf, 0, sgt_buf_size);
|
||||
|
||||
sgt = (struct dpaa2_sg_entry *)(sgt_buf + priv->tx_data_offset);
|
||||
|
||||
/* Fill in the HW SGT structure.
|
||||
|
@ -421,7 +423,7 @@ static int build_sg_fd(struct dpaa2_eth_priv *priv,
|
|||
return 0;
|
||||
|
||||
dma_map_single_failed:
|
||||
kfree(sgt_buf);
|
||||
skb_free_frag(sgt_buf);
|
||||
sgt_buf_alloc_failed:
|
||||
dma_unmap_sg(dev, scl, num_sg, DMA_BIDIRECTIONAL);
|
||||
dma_map_sg_failed:
|
||||
|
@ -525,9 +527,9 @@ static void free_tx_fd(const struct dpaa2_eth_priv *priv,
|
|||
return;
|
||||
}
|
||||
|
||||
/* Free SGT buffer kmalloc'ed on tx */
|
||||
/* Free SGT buffer allocated on tx */
|
||||
if (fd_format != dpaa2_fd_single)
|
||||
kfree(skbh);
|
||||
skb_free_frag(skbh);
|
||||
|
||||
/* Move on with skb release */
|
||||
dev_kfree_skb(skb);
|
||||
|
|
Loading…
Reference in a new issue