linux-kernel - Re: [PATCH] x86-64: pci-gart iommu sg chaining zeroes wrong sg.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <46FF89D6.4090201@panasas.com>
Date:	Sun, 30 Sep 2007 13:34:46 +0200
From:	Benny Halevy <bhalevy@...asas.com>
To:	FUJITA Tomonori <tomof@....org>
CC:	jens.axboe@...cle.com, linux-kernel@...r.kernel.org,
	linux-scsi@...r.kernel.org, fujita.tomonori@....ntt.co.jp
Subject: Re: [PATCH] x86-64: pci-gart iommu sg chaining zeroes wrong sg.

On Sep 27, 2007, 18:46 +0200, FUJITA Tomonori <tomof@....org> wrote:
> On Fri, 28 Sep 2007 01:38:27 +0900
> FUJITA Tomonori <tomof@....org> wrote:
> 
>> This patch is for Jens' block tree (sg chaining branch).
>>
>> I don't have the hardware but this looks like a bug.
>>
>> ---
>> From: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
>> Subject: [PATCH] x86-64: pci-gart iommu sg chaining zeroes a wrong sg's dma_length
>>
>> Needs to zero the end of the list.
>>
>> Signed-off-by: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
>> ---
>>  arch/x86_64/kernel/pci-gart.c |    3 ++-
>>  1 files changed, 2 insertions(+), 1 deletions(-)
>>
>> diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
>> index 27b7db4..a4151a7 100644
>> --- a/arch/x86_64/kernel/pci-gart.c
>> +++ b/arch/x86_64/kernel/pci-gart.c
>> @@ -425,9 +425,10 @@ int gart_map_sg(struct device *dev, struct scatterlist *sg, int nents, int dir)
>>  	if (dma_map_cont(start_sg, i - start, sgmap, pages, need) < 0)
>>  		goto error;
>>  	out++;
>> +	sgmap = sg_next(sgmap);
>>  	flush_gart();
>>  	if (out < nents)
>> -		ps->dma_length = 0;
>> +		sgmap->dma_length = 0;
>>  	return out;
> 
> Sorry, it should be:
> 
> 
> diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
> index 27b7db4..cfcc84e 100644
> --- a/arch/x86_64/kernel/pci-gart.c
> +++ b/arch/x86_64/kernel/pci-gart.c
> @@ -426,8 +426,10 @@ int gart_map_sg(struct device *dev, struct scatterlist *sg, int nents, int dir)
>  		goto error;
>  	out++;
>  	flush_gart();
> -	if (out < nents)
> -		ps->dma_length = 0;
> +	if (out < nents) {
> +		sgmap = sg_next(sgmap);
> +		sgmap->dma_length = 0;
> +	}

looks correct to me.
ps points at the previous "scanned" sg entry while you want to zero out
dma_length at the entry immediately following the last entry mapped
(if (out < nents))

the original code before 62296749bd421904dace1e6b0fc3c4538aac7111 was:
-	if (out < nents) 
-		sg[out].dma_length = 0; 

Benny

>  	return out;
>  
>  error:
> -
> To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/