Messages in this thread | | | From | Marin Mitov <> | Subject | Re: [BUG][PATCH]dma-coherent.c: error path bug | Date | Mon, 7 Jun 2010 07:08:56 +0300 |
| |
On Monday, June 07, 2010 05:30:48 am FUJITA Tomonori wrote: > On Sun, 6 Jun 2010 13:53:04 +0300 > Marin Mitov <mitov@issp.bas.bg> wrote: > > > Hi all, > > > > The error path in dma_declare_coherent_memory() leaves > > the pointer dev->dma_mem non completely initialized. > > > > If allocation of dev->dma_mem succeeds, > > but allocation of dev->dma_mem->bitmap fails > > dev->dma_mem is freed, but left non NULL > > and non completely initialized. > > > > Either zero it after being freed (one liner patch), or assign to > > dev->dma_mem only completely initialized structure (patch included). > > > > Comments welcome. > > > > Marin Mitov > > > > Signed-off-by: Marin Mitov <mitov@issp.bas.bg> > > Hmm, if dma_declare_coherent_memory() fails, the driver doesn't use > dev->dma_mem. So even if dev->dma_mem points to a freed memory, I'm > not sure that it causes a real problem. We could call this patch a > cleanup though. > My understanding of dma_alloc_coherent() is that we first try to allocate from per-device coherent memory and we do it using dma_alloc_from_coherent() (in drivers/base/dma-coherent.c) if dev->dma_mem is not NULL (and we have left it not NULL, here is the problem). If allocation of dev->dma_mem->bitmap fails dev->dma_mem must be NULL.
Marin Mitov
| |