From nobody Tue Dec 26 02:04:15 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SzdPD2YKBz55KPK; Tue, 26 Dec 2023 02:04:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SzdPD15mKz4KCp; Tue, 26 Dec 2023 02:04:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1703556256; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qKEz472WTo9qIf9iKc4wMQJN8/1Qs+vetPq4XuJ/QZk=; b=B16r3kirLCj1nkdz5p3slcy3nAILBiF8+ob2rH4q8cToBtPhU3xrCLNG05kS1mhW36vVIJ 8xqz/CE0p92BES0fmzY+XGPbVizaHaMoO7gbLTvSd+GX+PlFMcTC3xer1eO4imI2NfAIWO N/ctbZawSoozQJfOfuj6HOd0f26n/NviQSpbvnOr2RCWJDxqRYAnENp1yV66fnMIl7wfS+ 01LGOpXBJPUBGTv5cpzq4MbSdIh6cSWMI6lolZ1RfixbQFc8L3IUofhRbyas/5BS6l9P8Z +fH40+MEBs8wlRLAM26IAaPaQTA1cXL9PzTiSjZtDVJti6Fc7ZOlgaFZ7Cg3WQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1703556256; a=rsa-sha256; cv=none; b=bA5YfdGh1rPeChCtzVjAChdil3NkVNQez033Y8uiBs/qgtbMWNMMfowofHp3PPNOgN0V+a FSxa6WcRDLHuyM41/15on3MvdXtHwXXq/UU33hvxZxzBoDac3pxfGIERWAnzDKuVojaiL1 tIQIFvJNW1/cBmjhM/TFv/ufEd96PhPi/IJTS+rICgaxfxVMMGpkpQ9e1t/DRXg01RWpUE rI+NJGsf/S9SA2GYklO8cQexQuPvv6Lw2WRcQz9b3u9k5rgWIaLahCGw69Kx4/yjUaGnBv FXoKPIZpZ5Zx2YCFUUTRfXVWBcnwcb8/JuHSAdpuU9Wm9IrPb7eD9Vxyi61Ewg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1703556256; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qKEz472WTo9qIf9iKc4wMQJN8/1Qs+vetPq4XuJ/QZk=; b=fksNLYoqN8w0BAQFKe5D9hHUxzeTO2j8N/FIkjldjP1WgOJW0MHHfp1UP8FJCbUKbPGtZ6 jcD8IO3AOOlog+VsPiAYA6fJA47lVYKIgVV6j7g022W1SPt0daNBIdFOtYjs0byi4HXKec DImBTJpa7s+WQfjIP35jvF5lGvBch2sgsJVR1HviQiDzwCgpDZNiVg0I+fr12qEK3wpR4m wCsmXuoaqlrkj9KS4pOM4xXURFO/jbt/RofAzOWDuvwZLUYuk6ZhHEG6+Kx9xAR2qmDITy ofyI05ptdNlNV4pQuzGW++z4n22MKaOEK41A/3WbaAlp0hhcKVlZAcBJAFuU4A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4SzdPD0D1mzbl9; Tue, 26 Dec 2023 02:04:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 3BQ24FMa002845; Tue, 26 Dec 2023 02:04:15 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 3BQ24FSj002842; Tue, 26 Dec 2023 02:04:15 GMT (envelope-from git) Date: Tue, 26 Dec 2023 02:04:15 GMT Message-Id: <202312260204.3BQ24FSj002842@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 6bfb7306ef92 - main - mpi3mr: Check for copyin errors in mpi3mr_map_data_buffer_dma() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 6bfb7306ef92aaccffae42ed00ce6d7201b76966 Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6bfb7306ef92aaccffae42ed00ce6d7201b76966 commit 6bfb7306ef92aaccffae42ed00ce6d7201b76966 Author: Mark Johnston AuthorDate: 2023-12-26 01:38:12 +0000 Commit: Mark Johnston CommitDate: 2023-12-26 02:04:00 +0000 mpi3mr: Check for copyin errors in mpi3mr_map_data_buffer_dma() A failed copyin will cause the driver to use the contents of uninitialized buffers instead, which is unlikely to be the behaviour that we want. Check for errors. This is in preparation for annotating copyin() and related functions with __result_use_check. Reviewed by: imp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D43098 --- sys/dev/mpi3mr/mpi3mr_app.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sys/dev/mpi3mr/mpi3mr_app.c b/sys/dev/mpi3mr/mpi3mr_app.c index 99a922b2bec9..7bd926269018 100644 --- a/sys/dev/mpi3mr/mpi3mr_app.c +++ b/sys/dev/mpi3mr/mpi3mr_app.c @@ -543,6 +543,7 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_softc *sc, { U16 i, needed_desc = (dma_buffers->kern_buf_len / MPI3MR_IOCTL_SGE_SIZE); U32 buf_len = dma_buffers->kern_buf_len, copied_len = 0; + int error; if (dma_buffers->kern_buf_len % MPI3MR_IOCTL_SGE_SIZE) needed_desc++; @@ -558,6 +559,7 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_softc *sc, if (!dma_buffers->dma_desc) return -1; + error = 0; for (i = 0; i < needed_desc; i++, desc_count++) { dma_buffers->dma_desc[i].addr = sc->ioctl_sge[desc_count].addr; @@ -572,12 +574,19 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_softc *sc, memset(dma_buffers->dma_desc[i].addr, 0, sc->ioctl_sge[desc_count].size); if (dma_buffers->data_dir == MPI3MR_APP_DDO) { - copyin(((U8 *)dma_buffers->user_buf + copied_len), + error = copyin(((U8 *)dma_buffers->user_buf + copied_len), dma_buffers->dma_desc[i].addr, dma_buffers->dma_desc[i].size); + if (error != 0) + break; copied_len += dma_buffers->dma_desc[i].size; } } + if (error != 0) { + printf("%s: DMA copyin error %d\n", __func__, error); + free(dma_buffers->dma_desc, M_MPI3MR); + return -1; + } dma_buffers->num_dma_desc = needed_desc;