netdev - Re: [PATCH net-next] net: thunderbolt: Clear finished Tx frame bus address in tbnet_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Nov 2017 12:21:48 +0200
From:   Mika Westerberg <mika.westerberg@...ux.intel.com>
To:     David Miller <davem@...emloft.net>
Cc:     michael.jamet@...el.com, yehezkel.bernat@...el.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net: thunderbolt: Clear finished Tx frame bus
 address in tbnet_tx_callback()

On Sat, Nov 11, 2017 at 07:21:24PM +0900, David Miller wrote:
> From: Mika Westerberg <mika.westerberg@...ux.intel.com>
> Date: Thu,  9 Nov 2017 13:46:28 +0300
> 
> > When Thunderbolt network interface is disabled or when the cable is
> > unplugged the driver releases all allocated buffers by calling
> > tbnet_free_buffers() for each ring. This function then calls
> > dma_unmap_page() for each buffer it finds where bus address is non-zero.
> > Now, we only clear this bus address when the Tx buffer is sent to the
> > hardware so it is possible that the function finds an entry that has
> > already been unmapped.
> > 
> > Enabling DMA-API debugging catches this as well:
> > 
> >   thunderbolt 0000:06:00.0: DMA-API: device driver tries to free DMA
> >     memory it has not allocated [device address=0x0000000068321000] [size=4096 bytes]
> > 
> > Fix this by clearing the bus address of a Tx frame right after we have
> > unmapped the buffer.
> > 
> > Signed-off-by: Mika Westerberg <mika.westerberg@...ux.intel.com>
> 
> Applied, but assuming zero is a non-valid DMA address is never a good
> idea.  That's why we have the DMA error code signaling abstracted.

There does not seem to be a way to mark DMA address invalid in a driver
so we probably need to add a flag to struct tbnet_frame instead.