linux-kernel - Re: [PATCH dma 1/1] dma-direct: correct the physical addr in dma_direct_sync_sg_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 19 Jul 2019 11:38:16 +0100
From:   Robin Murphy <robin.murphy@....com>
To:     fugang.duan@....com, hch@....de, m.szyprowski@...sung.com
Cc:     festevam@...il.com, iommu@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org, aisheng.dong@....com,
        Al Farleigh <AWFour@...rter.net>
Subject: Re: [PATCH dma 1/1] dma-direct: correct the physical addr in
 dma_direct_sync_sg_for_cpu/device

On 19/07/2019 10:26, fugang.duan@....com wrote:
> From: Fugang Duan <fugang.duan@....com>
> 
> dma_map_sg() may use swiotlb buffer when kernel parameter include
> "swiotlb=force" or the dma_addr is out of dev->dma_mask range. After
> DMA complete the memory moving from device to memory, then user call
> dma_sync_sg_for_cpu() to sync with DMA buffer, and copy the original
> virtual buffer to other space.
> 
> So dma_direct_sync_sg_for_cpu() should use swiotlb physical addr, not
> the original physical addr from sg_phys(sg).
> 
> dma_direct_sync_sg_for_device() also has the similar issue, correct it.

Yikes, that was unfortunate. There aren't too many users of 
dma_sync_sg*(), but I note that a few of them are in and around v4l2, so 
this could well explain the video brokenness that Al reported.

AFAICS the fix looks appropriate;

Reviewed-by: Robin Murphy <robin.murphy@....com>

> Fixes: 55897af63091("dma-direct: merge swiotlb_dma_ops into the dma_direct code")
> Signed-off-by: Fugang Duan <fugang.duan@....com>
> ---
>   kernel/dma/direct.c | 18 +++++++++++-------
>   1 file changed, 11 insertions(+), 7 deletions(-)
> 
> diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
> index b90e1ae..0e87f86 100644
> --- a/kernel/dma/direct.c
> +++ b/kernel/dma/direct.c
> @@ -242,12 +242,14 @@ void dma_direct_sync_sg_for_device(struct device *dev,
>   	int i;
>   
>   	for_each_sg(sgl, sg, nents, i) {
> -		if (unlikely(is_swiotlb_buffer(sg_phys(sg))))
> -			swiotlb_tbl_sync_single(dev, sg_phys(sg), sg->length,
> +		phys_addr_t paddr = dma_to_phys(dev, sg_dma_address(sg));
> +
> +		if (unlikely(is_swiotlb_buffer(paddr)))
> +			swiotlb_tbl_sync_single(dev, paddr, sg->length,
>   					dir, SYNC_FOR_DEVICE);
>   
>   		if (!dev_is_dma_coherent(dev))
> -			arch_sync_dma_for_device(dev, sg_phys(sg), sg->length,
> +			arch_sync_dma_for_device(dev, paddr, sg->length,
>   					dir);
>   	}
>   }
> @@ -279,11 +281,13 @@ void dma_direct_sync_sg_for_cpu(struct device *dev,
>   	int i;
>   
>   	for_each_sg(sgl, sg, nents, i) {
> +		phys_addr_t paddr = dma_to_phys(dev, sg_dma_address(sg));
> +
>   		if (!dev_is_dma_coherent(dev))
> -			arch_sync_dma_for_cpu(dev, sg_phys(sg), sg->length, dir);
> -	
> -		if (unlikely(is_swiotlb_buffer(sg_phys(sg))))
> -			swiotlb_tbl_sync_single(dev, sg_phys(sg), sg->length, dir,
> +			arch_sync_dma_for_cpu(dev, paddr, sg->length, dir);
> +
> +		if (unlikely(is_swiotlb_buffer(paddr)))
> +			swiotlb_tbl_sync_single(dev, paddr, sg->length, dir,
>   					SYNC_FOR_CPU);
>   	}
>   
>