linux-kernel - Re: [PATCH] drm/tinydrm: mipi-dbi: Fix unbalanced DMA access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Aug 2017 08:49:52 +0200
From:   Noralf Trønnes <noralf@...nnes.org>
To:     David Lechner <david@...hnology.com>,
        dri-devel@...ts.freedesktop.org
Cc:     David Airlie <airlied@...ux.ie>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/tinydrm: mipi-dbi: Fix unbalanced DMA access


Den 04.08.2017 00.41, skrev David Lechner:
> On 08/01/2017 03:14 PM, David Lechner wrote:
>> If we return here and import_attach is true, then 
>> dma_buf_end_cpu_access()
>> will not be called balance dma_buf_begin_cpu_access().
>>
>> Fix by setting ret instead of returning.
>>
>> Signed-off-by: David Lechner <david@...hnology.com>
>> ---
>>   drivers/gpu/drm/tinydrm/mipi-dbi.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/tinydrm/mipi-dbi.c 
>> b/drivers/gpu/drm/tinydrm/mipi-dbi.c
>> index c83eeb7..e10fa4b 100644
>> --- a/drivers/gpu/drm/tinydrm/mipi-dbi.c
>> +++ b/drivers/gpu/drm/tinydrm/mipi-dbi.c
>> @@ -183,7 +183,8 @@ static int mipi_dbi_buf_copy(void *dst, struct 
>> drm_framebuffer *fb,
>>           dev_err_once(fb->dev->dev, "Format is not supported: %s\n",
>>                    drm_get_format_name(fb->format->format,
>>                            &format_name));
>> -        return -EINVAL;
>> +        ret = -EINVAL;
>> +        break;
>>       }
>>         if (import_attach)
>>
>
>
> I just realized that the next line here can mask ret.
>
>
>     if (import_attach)
>         ret = dma_buf_end_cpu_access(import_attach->dmabuf,
>                          DMA_FROM_DEVICE);
>
> So, we should either ignore the return value from 
> dma_buf_end_cpu_access() always or add some logic to ignore it if ret 
> is already an error.
>
> In some of the other patches I have been sending, we have the same 
> situation. I those, I have opted to just ignore the return value from 
> dma_buf_end_cpu_access(). e.g...
>
>
>     if (import_attach)
>         dma_buf_end_cpu_access(import_attach->dmabuf, DMA_FROM_DEVICE);
>
> Is this a reasonable thing to do?

mipi_dbi_buf_copy() can be used by other rgb565 controllers, hence
the format check I think. So when that happens, it can be moved to
tinydrm-helpers.

Currently it's not possible to get an illegal format, since mipi-dbi
only supports those two formats.
Userspace can't set an illegal format, beacuse it's checked:
drm_atomic_commit -> drm_atomic_check_only -> drm_atomic_plane_check ->
drm_plane_check_pixel_format

So I think we can just leave this alone, or put the check before
import_attach if you really want to put this straight.

Noralf.