linux-kernel - Re: [RFC PATCH v3] arm DMA: Fix allocation from CMA for coherent DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 29 Jun 2015 12:05:33 +0100
From:	Catalin Marinas <catalin.marinas@....com>
To:	Russell King - ARM Linux <linux@....linux.org.uk>
Cc:	Arnd Bergmann <arnd@...db.de>, Lorenzo Nava <lorenx4@...il.com>,
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: [RFC PATCH v3] arm DMA: Fix allocation from CMA for coherent DMA

On Mon, Jun 29, 2015 at 11:46:04AM +0100, Russell King - ARM Linux wrote:
> On Mon, Jun 29, 2015 at 11:37:37AM +0100, Catalin Marinas wrote:
> > I forgot about the arm_dma_mmap fix here:
> > 
> > https://lkml.org/lkml/2015/5/7/512
> > 
> > So we either fix both cases by changing __get_dma_pgprot() or just go
> > for Mike's and your patches as above. It's up to Russell.
> 
> I'd prefer the "least code" option. :)
> 
> > At some point, we could do with some more clean-up in the dma-mapping.c.
> > For example, both __alloc_simple_buffer() and __alloc_from_contiguous()
> > end up calling __dma_clear_buffer() even when not necessary (cacheable
> > mapping). Not too bad though as this is only done when setting up the
> > buffer.
> 
> The reason we always clear the buffer is that we can't be sure that a
> driver will not map a buffer allocated by dma_alloc_coherent() into
> userspace without it first being initialised.  There have been drivers
> which do this (ALSA in particular.)  I haven't checked whether this
> instance still does this, but it used to - and the problem is once
> one instance exists, it gets copied...

You are right, the memset'ing is probably still necessary to patch
potential security holes. The cache flushing is not for coherent buffers
(sometimes this may be more expensive than the memset itself, though
lost in the noise if only done once).

-- 
Catalin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/