diff mbox series

net: can: add missing urb->transfer_dma initialization

Message ID 20210725103630.23864-1-paskripkin@gmail.com (mailing list archive)
State Awaiting Upstream
Delegated to: Netdev Maintainers
Headers show
Series net: can: add missing urb->transfer_dma initialization | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Guessed tree name to be net-next
netdev/subject_prefix warning Target tree name not specified in the subject
netdev/cc_maintainers warning 6 maintainers not CCed: davem@davemloft.net mailhol.vincent@wanadoo.fr socketcan@hartkopp.net colin.king@canonical.com trix@redhat.com kuba@kernel.org
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 8 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/header_inline success Link

Commit Message

Pavel Skripkin July 25, 2021, 10:36 a.m. UTC
Yasushi reported, that his Microchip CAN Analyzer stopped working since
commit 91c02557174b ("can: mcba_usb: fix memory leak in mcba_usb").
The problem was in missing urb->transfer_dma initialization.

In my previous patch to this driver I refactored mcba_usb_start() code to
avoid leaking usb coherent buffers. To achive it, I passed local stack
variable to usb_alloc_coherent() and then saved it to private array to
correctly free all coherent buffers on ->close() call. But I forgot to
inialize urb->transfer_dma with variable passed to usb_alloc_coherent().

All of this was causing device to not work, since dma addr 0 is not valid
and following log can be found on bug report page, which points exactly to
problem described above.

[   33.862175] DMAR: [DMA Write] Request device [00:14.0] PASID ffffffff fault addr 0 [fault reason 05] PTE Write access is not set

Bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990850

Reported-by: Yasushi SHOJI <yasushi.shoji@gmail.com>
Fixes: 91c02557174b ("can: mcba_usb: fix memory leak in mcba_usb")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 drivers/net/can/usb/mcba_usb.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Yasushi SHOJI July 25, 2021, 1:27 p.m. UTC | #1
Hi Pavel,

I've tested this patch on top of v5.14-rc2.  All good.

Tested-by: Yasushi SHOJI <yashi@spacecubics.com>

Some nitpicks.

On Sun, Jul 25, 2021 at 7:36 PM Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> Yasushi reported, that his Microchip CAN Analyzer stopped working since
> commit 91c02557174b ("can: mcba_usb: fix memory leak in mcba_usb").
> The problem was in missing urb->transfer_dma initialization.
>
> In my previous patch to this driver I refactored mcba_usb_start() code to
> avoid leaking usb coherent buffers. To achive it, I passed local stack

achieve

> variable to usb_alloc_coherent() and then saved it to private array to
> correctly free all coherent buffers on ->close() call. But I forgot to
> inialize urb->transfer_dma with variable passed to usb_alloc_coherent().

initialize

> All of this was causing device to not work, since dma addr 0 is not valid
> and following log can be found on bug report page, which points exactly to
> problem described above.
>
> [   33.862175] DMAR: [DMA Write] Request device [00:14.0] PASID ffffffff fault addr 0 [fault reason 05] PTE Write access is not set
>
> Bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990850
>
> Reported-by: Yasushi SHOJI <yasushi.shoji@gmail.com>
> Fixes: 91c02557174b ("can: mcba_usb: fix memory leak in mcba_usb")
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
>  drivers/net/can/usb/mcba_usb.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
> index a45865bd7254..a1a154c08b7f 100644
> --- a/drivers/net/can/usb/mcba_usb.c
> +++ b/drivers/net/can/usb/mcba_usb.c
> @@ -653,6 +653,8 @@ static int mcba_usb_start(struct mcba_priv *priv)
>                         break;
>                 }
>
> +               urb->transfer_dma = buf_dma;
> +
>                 usb_fill_bulk_urb(urb, priv->udev,
>                                   usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),
>                                   buf, MCBA_USB_RX_BUFF_SIZE,
> --
> 2.32.0

Pavel, thanks again for your quick fix. :-)

Best,
--
               yashi
Marc Kleine-Budde July 25, 2021, 4:30 p.m. UTC | #2
On 25.07.2021 22:27:37, Yasushi SHOJI wrote:
> Hi Pavel,
> 
> I've tested this patch on top of v5.14-rc2.  All good.
> 
> Tested-by: Yasushi SHOJI <yashi@spacecubics.com>
> 
> Some nitpicks.
> 
> On Sun, Jul 25, 2021 at 7:36 PM Pavel Skripkin <paskripkin@gmail.com> wrote:
> >
> > Yasushi reported, that his Microchip CAN Analyzer stopped working since
> > commit 91c02557174b ("can: mcba_usb: fix memory leak in mcba_usb").
> > The problem was in missing urb->transfer_dma initialization.
> >
> > In my previous patch to this driver I refactored mcba_usb_start() code to
> > avoid leaking usb coherent buffers. To achive it, I passed local stack
> 
> achieve
> 
> > variable to usb_alloc_coherent() and then saved it to private array to
> > correctly free all coherent buffers on ->close() call. But I forgot to
> > inialize urb->transfer_dma with variable passed to usb_alloc_coherent().
> 
> initialize

Fixed while applying.

Thanks,
Marc
diff mbox series

Patch

diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index a45865bd7254..a1a154c08b7f 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -653,6 +653,8 @@  static int mcba_usb_start(struct mcba_priv *priv)
 			break;
 		}
 
+		urb->transfer_dma = buf_dma;
+
 		usb_fill_bulk_urb(urb, priv->udev,
 				  usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),
 				  buf, MCBA_USB_RX_BUFF_SIZE,