linux-kernel - Re: [PATCH v4 1/4] usb: dbc: early driver for xhci debug capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 Nov 2016 09:13:16 +0800
From:   Lu Baolu <baolu.lu@...ux.intel.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Mathias Nyman <mathias.nyman@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>, linux-usb@...r.kernel.org,
        x86@...nel.org, LKML <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH v4 1/4] usb: dbc: early driver for xhci debug capability

Hi,

On 11/09/2016 05:23 PM, Thomas Gleixner wrote:
> On Tue, 1 Nov 2016, Lu Baolu wrote:
>> +static int __init xdbc_init(void)
>> +{
> ...
>> +	base = ioremap_nocache(xdbc.xhci_start, xdbc.xhci_length);
>> +	if (!base) {
>> +		xdbc_trace("failed to remap the io address\n");
>> +		ret = -ENOMEM;
>> +		goto free_and_quit;
>> +	}
>> +
>> +	early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
>> +	xdbc_trace("early mapped IO address released\n");
>> +
>> +	xdbc.xhci_base = base;
>> +	offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
>> +	xdbc.xdbc_reg = (struct xdbc_regs __iomem *)(xdbc.xhci_base + offset);
> This is broken. What prevents that 
>
>      - a printk is in progress on another cpu?
>
>      - a printk happens between the unmap and storing the new base ?
>
> Nothing AFAICT. So this needs to be done in a safe way. And just making it
>
> 	oldbase = xdbc.xhci_base;
> 	base = ioremap(....);
> 	xdbc.xhci_base = base;
> 	early_iounmap(oldbase);
>
> does not work either because the compiler can rightfully cache
> xdbc.xhci_base in the write related functions. The same issue with
> xdbc.xdbc_reg.

If there isn't a good solution, I will remove the ioremap code and let
it use the early mapped one.

Best regards,
Lu Baolu