[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAOZ5it34Gk_MU-gYzL5iuiHCx6fohQFSJFDp2AKj7waUCNzLyA@mail.gmail.com>
Date: Fri, 22 Nov 2024 13:34:20 -0700
From: Brian Johannesmeyer <bjohannesmeyer@...il.com>
To: Tianyu Lan <Tianyu.Lan@...rosoft.com>, Christoph Hellwig <hch@....de>,
Marek Szyprowski <m.szyprowski@...sung.com>, Robin Murphy <robin.murphy@....com>, iommu@...ts.linux.dev,
linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Cc: Raphael Isemann <teemperor@...il.com>, Cristiano Giuffrida <giuffrida@...vu.nl>, Herbert Bos <h.j.bos@...nl>,
Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [RFC 1/1] swiotlb: Replace BUG_ON() with graceful error handling
On Fri, Nov 22, 2024 at 12:13 PM Brian Johannesmeyer
<bjohannesmeyer@...il.com> wrote:
>
> Replace the BUG_ON() assertion in swiotlb_release_slots() with a
> conditional check and return. This change prevents a corrupted tlb_addr
> from causing a kernel panic.
>
> Co-developed-by: Raphael Isemann <teemperor@...il.com>
> Signed-off-by: Raphael Isemann <teemperor@...il.com>
> Signed-off-by: Brian Johannesmeyer <bjohannesmeyer@...il.com>
> ---
> kernel/dma/swiotlb.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
> index aa0a4a220719..54b4f9665772 100644
> --- a/kernel/dma/swiotlb.c
> +++ b/kernel/dma/swiotlb.c
> @@ -834,7 +834,11 @@ static void swiotlb_release_slots(struct device *dev, phys_addr_t tlb_addr)
> * While returning the entries to the free list, we merge the entries
> * with slots below and above the pool being returned.
> */
> - BUG_ON(aindex >= mem->nareas);
> + if (unlikely(aindex >= mem->nareas)) {
> + dev_err(dev, "%s: invalid area index (%d >= %d)\n", __func__,
> + aindex, mem->nareas);
> + return;
> + }
>
> spin_lock_irqsave(&area->lock, flags);
> if (index + nslots < ALIGN(index + 1, IO_TLB_SEGSIZE))
> --
> 2.34.1
>
Whoops -- didn't send to the hardening mailing list. Adding it now.
-Brian
Powered by blists - more mailing lists