linux-kernel - [PATCH] Fix strange panic message selection logic when swiotlb fills up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4A5B8CAC.3060906@redhat.com>
Date:	Mon, 13 Jul 2009 15:36:12 -0400
From:	Casey Dahlin <cdahlin@...hat.com>
To:	torvalds@...ux-foundation.org
CC:	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: [PATCH] Fix strange panic message selection logic when swiotlb fills
 up

swiotlb_full in lib/swiotlb.c contains the following code snippet to produce a panic when the software iotlb is too full to handle a new allocation:

	if (size > io_tlb_overflow && do_panic) {
		if (dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL)
			panic("DMA: Memory would be corrupted\n");
		if (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)
			panic("DMA: Random memory would be DMAed\n");
	}

Note the path when dir == DMA_BIDIRECTIONAL. The first panic() will be called always, yet the second if statement still checks for DMA_BIDIRECTIONAL. Unless we intend to panic twice, this is somewhat confusing.

This patch adds a third, separate error for DMA_BIDIRECTIONAL to make things a bit clearer.

diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index bffe6d7..35e01b3 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -625,12 +625,15 @@ swiotlb_full(struct device *dev, size_t size, int dir, int do_panic)
 	printk(KERN_ERR "DMA: Out of SW-IOMMU space for %zu bytes at "
 	       "device %s\n", size, dev ? dev_name(dev) : "?");
 
-	if (size > io_tlb_overflow && do_panic) {
-		if (dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL)
-			panic("DMA: Memory would be corrupted\n");
-		if (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)
-			panic("DMA: Random memory would be DMAed\n");
-	}
+	if (size <= io_tlb_overflow || !do_panic)
+		return;
+
+	if (dir == DMA_BIDIRECTIONAL)
+		panic("DMA: Random memory could be corrupted or DMAed\n");
+	if (dir == DMA_FROM_DEVICE)
+		panic("DMA: Memory would be corrupted\n");
+	if (dir == DMA_TO_DEVICE)
+		panic("DMA: Random memory would be DMAed\n");
 }
 
 /*
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/