From nobody Wed Feb 11 16:13:49 2026 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCD52152505; Wed, 27 Mar 2024 23:32:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=83.149.199.84 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711582367; cv=none; b=L/9EQEhzcUXOTTAkGIhCrSefCkTDT/eBmyFDT5inXkuC0oXvIUPOlp5W1GiQemCZ38M7k/e7D+Y9moUUqE1VtZz/1Vr33e7KzYUeTLgdsdsKeCGIy6LGH0zHoIGXSG9wpoL2b8J6XyGv5uvf4gIcNpPQuuXqCFA0TSUDNX2C1bg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711582367; c=relaxed/simple; bh=eHSSgsbK1rqU2YbdPmS6PWjfXAy5g8Zq7TGAJaYLS8I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=BBkSn0YIC4v8BgX8SD5CzChfYGW7hcT4mqZUgXgh9yLiW5+ppTYcejN2kIiMN1c/BL90E40vzL4+/7p9T4bmjexhlquuXBbagN8RN2gq7cPOvd/1BcueEDI0ydtPXro3N7ojl1QYVre+C83Zx0L5jAUEBm9ZtYI90VWDcHo4qIc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ispras.ru; spf=pass smtp.mailfrom=ispras.ru; dkim=pass (1024-bit key) header.d=ispras.ru header.i=@ispras.ru header.b=UMI5QwJy; arc=none smtp.client-ip=83.149.199.84 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ispras.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ispras.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ispras.ru header.i=@ispras.ru header.b="UMI5QwJy" Received: from tundra.lovozera (unknown [178.176.72.89]) by mail.ispras.ru (Postfix) with ESMTPSA id 270DC4076743; Wed, 27 Mar 2024 23:32:35 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 270DC4076743 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1711582355; bh=woxLEnCoTio3lIKiy9FPxfvzbuc49vi+0knM8PWIYrg=; h=From:To:Cc:Subject:Date:From; b=UMI5QwJyKrA0XUM7tYplkhayU8OvaHyeJaFK+Y4Rxy6cfrJo8roYbtwezferRTr4w LBjQyNgSAqngUfRhIEtUDM9I1Ob08V0Dq6LF3LvfmbptOvE3sauPu3h2zfiK1KVVhC +pdZoJPRWm3sekUHW4jEwYMoiWLD8QeBQW3BJdpA= From: Mikhail Kobuk To: Andy Walls Cc: Mikhail Kobuk , Mauro Carvalho Chehab , Christophe JAILLET , Hans Verkuil , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, Alexey Khoroshilov Subject: [PATCH] pci: ivtv: Add check for DMA map result Date: Thu, 28 Mar 2024 02:32:23 +0300 Message-ID: <20240327233226.5919-1-m.kobuk@ispras.ru> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In case DMA fails, 'dma->SG_length' is 0. This value is later used to access 'dma->SGarray[dma->SG_length - 1]', which will cause out of bounds access. Add check to return early on invalid value. Adjust warnings accordingly. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1932dc2f4cf6 ("media: pci/ivtv: switch from 'pci_' to 'dma_' API") Signed-off-by: Mikhail Kobuk --- drivers/media/pci/ivtv/ivtv-udma.c | 8 ++++++++ drivers/media/pci/ivtv/ivtv-yuv.c | 6 ++++++ drivers/media/pci/ivtv/ivtvfb.c | 6 +++--- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/media/pci/ivtv/ivtv-udma.c b/drivers/media/pci/ivtv/iv= tv-udma.c index 99b9f55ca829..f467a00492f4 100644 --- a/drivers/media/pci/ivtv/ivtv-udma.c +++ b/drivers/media/pci/ivtv/ivtv-udma.c @@ -131,6 +131,8 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivt= v_dest_addr, =20 /* Fill SG List with new values */ if (ivtv_udma_fill_sg_list(dma, &user_dma, 0) < 0) { + IVTV_DEBUG_WARN("%s: could not allocate bounce buffers for highmem users= pace buffers\n", + __func__); unpin_user_pages(dma->map, dma->page_count); dma->page_count =3D 0; return -ENOMEM; @@ -139,6 +141,12 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long iv= tv_dest_addr, /* Map SG List */ dma->SG_length =3D dma_map_sg(&itv->pdev->dev, dma->SGlist, dma->page_count, DMA_TO_DEVICE); + if (!dma->SG_length) { + IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__); + unpin_user_pages(dma->map, dma->page_count); + dma->page_count =3D 0; + return -EINVAL; + } =20 /* Fill SG Array with new values */ ivtv_udma_fill_sg_array (dma, ivtv_dest_addr, 0, -1); diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivt= v-yuv.c index 582146f8d70d..2d9274537725 100644 --- a/drivers/media/pci/ivtv/ivtv-yuv.c +++ b/drivers/media/pci/ivtv/ivtv-yuv.c @@ -114,6 +114,12 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, st= ruct ivtv_user_dma *dma, } dma->SG_length =3D dma_map_sg(&itv->pdev->dev, dma->SGlist, dma->page_count, DMA_TO_DEVICE); + if (!dma->SG_length) { + IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__); + unpin_user_pages(dma->map, dma->page_count); + dma->page_count =3D 0; + return -EINVAL; + } =20 /* Fill SG Array with new values */ ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvf= b.c index 410477e3e621..d1ab7fee0d05 100644 --- a/drivers/media/pci/ivtv/ivtvfb.c +++ b/drivers/media/pci/ivtv/ivtvfb.c @@ -281,10 +281,10 @@ static int ivtvfb_prep_dec_dma_to_device(struct ivtv = *itv, /* Map User DMA */ if (ivtv_udma_setup(itv, ivtv_dest_addr, userbuf, size_in_bytes) <=3D 0) { mutex_unlock(&itv->udma.lock); - IVTVFB_WARN("ivtvfb_prep_dec_dma_to_device, Error with pin_user_pages: %= d bytes, %d pages returned\n", - size_in_bytes, itv->udma.page_count); + IVTVFB_WARN("%s, Error in ivtv_udma_setup: %d bytes, %d pages returned\n= ", + __func__, size_in_bytes, itv->udma.page_count); =20 - /* pin_user_pages must have failed completely */ + /* pin_user_pages or DMA must have failed completely */ return -EIO; } =20 --=20 2.44.0