From nobody Tue Jan 02 00:37:15 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4T3v7c06k9z55yld; Tue, 2 Jan 2024 00:37:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4T3v7b5rF5z3HdM; Tue, 2 Jan 2024 00:37:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704155835; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=chutXDWsmZ5VMvWNwHUMeGTUZVDaepxwxMlTaHeWnCA=; b=ON/+lZhvZeSoXmRqEslr9VhS8AhqJBkBm7DWc6KH/bzqH1Kg4VXAGl7aMSdw7sDzadjFhd /wGhYGZc97k3+Q4fVo31/1lUWL5Mzybw25cZ1DjMrSHVqdlIS8m/GWK++H0+BXnry/K06L 8E2qQGuhifJrS3DNaEmj8GcrWizuuB7ln+jRK/PezdXA5lICrbaVKp49LJXqenbHzXHwOG 5gFFXI5x+ln4Psr4QCIySgNSitec4JW2ZApX76nJ+RCSj2NH4RO/UqQE5ESnV0bfouWcf3 nHyzmcnyjBmtxmK6eOwQYx5ridPKxZcYePofZJIsxQUvRpQFSxQrEZRGMqtwjQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1704155835; a=rsa-sha256; cv=none; b=QWYr8Lujr5VqlpGlzorXk8Fh4ytc6/ktmR4gFmk+QzdF6nkJOWh9lx+RXs73JJopGhnkIO 303KDYcR3INPGEmZct5EV9carbK8XbymBczIjlVCCmbfQw5GmpBC3GGtKFgWUwCyEq4PaW n/zlsz4PiigQXmNuYg+1TtyJwLmLWgJuTBAug2v0Sw30GUBmZblpqFNLEWPhxhtvf9L3wl /SR48TivGrABNdZXPl9nx3EBLiEo1w6pQsA3P7tmW6AFopb3wr+BFXuOcSw9GxD3ll1sH1 dJtgjI+lH+kk3EO5/xvmGOegohr1c0F5B4zYviUuaSL8TaQtVmpStLldMiyp6Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704155835; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=chutXDWsmZ5VMvWNwHUMeGTUZVDaepxwxMlTaHeWnCA=; b=MXMCjB6fI5LGG0LRh+sdmlWqUobPmBFQgGL2fk8+Cip/XU531l3+tKziulMNfiSxkbsY2Q y3bwNp1m4NFNciw6Oef7d18ZRmvbna7+FdqM/keB421lrSD3q3DFWtwUwz+uAj31/FKYql 4HLFXMs6oByo8XoDJpIjCtQT90jasUKTq0COp54BGy2ADcZwCbn/OLfoNvMxGRguNzSN5G mxdxKmo0vg5L3y3oF2cg0rPjx9e/pEKWXBqdd+6Wi8CjP2DdJk5e2jA8CO/Ec1VTHcE/4v Xpb1SQhqz5Tj9p4/7Jakes1/nxl3vL5U0ll8kL6QO66aJO4LLwAzcJ3SaS1Tgw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4T3v7b4t7zzfQB; Tue, 2 Jan 2024 00:37:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 4020bFfM085077; Tue, 2 Jan 2024 00:37:15 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 4020bF0v085074; Tue, 2 Jan 2024 00:37:15 GMT (envelope-from git) Date: Tue, 2 Jan 2024 00:37:15 GMT Message-Id: <202401020037.4020bF0v085074@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8adca661c2bb - stable/14 - mpi3mr: Check for copyin errors in mpi3mr_map_data_buffer_dma() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 8adca661c2bbcec780d0ad532be4a870090e35db Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8adca661c2bbcec780d0ad532be4a870090e35db commit 8adca661c2bbcec780d0ad532be4a870090e35db Author: Mark Johnston AuthorDate: 2023-12-26 01:38:12 +0000 Commit: Mark Johnston CommitDate: 2024-01-02 00:29:45 +0000 mpi3mr: Check for copyin errors in mpi3mr_map_data_buffer_dma() A failed copyin will cause the driver to use the contents of uninitialized buffers instead, which is unlikely to be the behaviour that we want. Check for errors. This is in preparation for annotating copyin() and related functions with __result_use_check. Reviewed by: imp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D43098 (cherry picked from commit 6bfb7306ef92aaccffae42ed00ce6d7201b76966) --- sys/dev/mpi3mr/mpi3mr_app.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sys/dev/mpi3mr/mpi3mr_app.c b/sys/dev/mpi3mr/mpi3mr_app.c index 001753732a35..cf3afc7bba95 100644 --- a/sys/dev/mpi3mr/mpi3mr_app.c +++ b/sys/dev/mpi3mr/mpi3mr_app.c @@ -544,6 +544,7 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_softc *sc, { U16 i, needed_desc = (dma_buffers->kern_buf_len / MPI3MR_IOCTL_SGE_SIZE); U32 buf_len = dma_buffers->kern_buf_len, copied_len = 0; + int error; if (dma_buffers->kern_buf_len % MPI3MR_IOCTL_SGE_SIZE) needed_desc++; @@ -559,6 +560,7 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_softc *sc, if (!dma_buffers->dma_desc) return -1; + error = 0; for (i = 0; i < needed_desc; i++, desc_count++) { dma_buffers->dma_desc[i].addr = sc->ioctl_sge[desc_count].addr; @@ -573,12 +575,19 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_softc *sc, memset(dma_buffers->dma_desc[i].addr, 0, sc->ioctl_sge[desc_count].size); if (dma_buffers->data_dir == MPI3MR_APP_DDO) { - copyin(((U8 *)dma_buffers->user_buf + copied_len), + error = copyin(((U8 *)dma_buffers->user_buf + copied_len), dma_buffers->dma_desc[i].addr, dma_buffers->dma_desc[i].size); + if (error != 0) + break; copied_len += dma_buffers->dma_desc[i].size; } } + if (error != 0) { + printf("%s: DMA copyin error %d\n", __func__, error); + free(dma_buffers->dma_desc, M_MPI3MR); + return -1; + } dma_buffers->num_dma_desc = needed_desc;