linux-kernel - Re: [PATCH] Missing critical phys_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 06 Feb 2007 10:00:09 +0100
From:	Stefan Richter <stefanr@...6.in-berlin.de>
To:	Andi Kleen <ak@...e.de>
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	David Moore <dcm@....edu>,
	linux-kernel <linux-kernel@...r.kernel.org>, discuss@...-64.org,
	linux1394-devel <linux1394-devel@...ts.sourceforge.net>,
	Jan Beulich <jbeulich@...ell.com>
Subject: Re: [PATCH] Missing critical phys_to_virt in lib/swiotlb.c

On 2/6/2007 8:56 AM, Andi Kleen wrote:
>> > From: David Moore <dcm@....org>
...
>> > It fixes real crashes:
>> > http://lists.opensuse.org/opensuse-bugs/2006-12/msg02943.html
>> > http://qa.mandriva.com/show_bug.cgi?id=28224
>> > http://www.pchdtv.com/forum/viewtopic.php?t=2063&sid=a959a14a4c2db0eebaab7b0df56103ce
>> > 
>> > --- linux-2.6.19.x86_64/lib/swiotlb.c.orig	2007-02-04 13:18:41.000000000 -0500
>> > +++ linux-2.6.19.x86_64/lib/swiotlb.c	2007-02-04 13:19:43.000000000 -0500
>> > @@ -750,7 +750,7 @@ swiotlb_sync_sg(struct device *hwdev, st
>> >  
>> >  	for (i = 0; i < nelems; i++, sg++)
>> >  		if (sg->dma_address != SG_ENT_PHYS_ADDRESS(sg))
>> > -			sync_single(hwdev, (void *) sg->dma_address,
>> > +			sync_single(hwdev, phys_to_virt(sg->dma_address),
>> >  				    sg->dma_length, dir, target);
>> >  }
...
> Sounds weird. If this really didn't work much more should be broken
> (e.g. no cdroms/sound on Intel x86-64 boxes with >4GB)

Yes, it's weird; e.g. it seems that reports of that on linux1394-user
and -devel came in only recently. But I may have missed something.
(OTOH, this bug was partially hidden for FireWire users because one of
the relevant FireWire drivers was lacking respective _sync_sg calls.)

> I'm a little sceptical. Perhaps the TV driver is doing something bogus
> here? 

sync_single() definitely wants a virtual address there. sg->dma_address
is a physical address. The bug and the fix are obvious.

Unfortunately an author of lib/swiotlb.c chose to call many variables
holding *virtual* addresses "dma_addr". Note how that file at the same
time contains variables like "dma_addr_t dma_handle". A recipe for disaster.

> Also I haven't heard of this problem before at all and I'm sure I would
> have if sounds/cdroms were broken.
> 
> Shouldn't be applied without further analysis.

Maybe some recent changes elsewhere cause more frequent use of
swiotlb-driven bounce buffers? That should be verified.

Or maybe people are deploying affected hardware more often now?
-- 
Stefan Richter
-=====-=-=== --=- --==-
http://arcgraph.de/sr/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/