linux-kernel - Re: [PATCH]: x86_64, audio: Fix system panic when DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 02 May 2013 09:19:58 -0700
From:	Mike Travis <travis@....com>
To:	David Henningsson <david.henningsson@...onical.com>
CC:	Stephen Warren <swarren@...dia.com>,
	Jaroslav Kysela <perex@...ex.cz>, Takashi Iwai <tiwai@...e.de>,
	Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>,
	alsa-devel@...a-project.org, linux-kernel@...r.kernel.org,
	Russ Anderson <rja@....com>
Subject: Re: [PATCH]: x86_64, audio: Fix system panic when DMA > 40 bits



On 5/2/2013 1:29 AM, David Henningsson wrote:
> On 05/02/2013 08:36 AM, Mike Travis wrote:
>>
>>
>> On 5/1/2013 11:20 PM, David Henningsson wrote:
>>> On 05/01/2013 09:04 PM, Mike Travis wrote:
>>>> The audio driver mistakenly allows 64 bit addresses to be created for
>>>> the audio driver on Nvidia GPUs.  Unfortunately, the hardware normally
>>>> only supports up to 40 bits of DMA.  This can cause system panics as
>>>> well as misdirected data when the address is > 40 bits as the upper
>>>> part the address is truncated.
>>>
>>> Thanks for this patch. Stephen Warren, is this something you can
>>> confirm/deny, and do you know what range of hardware this actually
>>> applies to?
>>
>> The dma_mask can be read from the gpu device's pci entry.  I know it's
>> a stretch to try to link to that but past history has shown that it
>> ranges from 36 to 40 bits.
> 
> Ok, so the below patch is some kind of workaround, as we don't currently
> take the dma_mask into account correctly? Or put in another way, would
> it be possible/better to actually read the dma_mask and use that instead
> of just clamping at 32 bit?\

Yes, it would.  There is a strange scenario where if you request
a DMA32 address it must be on the lowest node (where the DMA32 area
is).  But if you are running on a cpuset that excludes Node 0's
memory, you'll get an error.  But I couldn't think of a workable
way to link the two (except that the PCI id is the same except
for the function #.)
>>>
>>>>
>>>> Signed-off-by: Mike Travis <travis@....com>
>>>> Reviewed-by: Mike Habeck <habeck@....com>
>>>> ---
>>>>    sound/pci/hda/hda_intel.c | 2 +-
>>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
>>>> index bcd40ee..45eb165 100644
>>>> --- a/sound/pci/hda/hda_intel.c
>>>> +++ b/sound/pci/hda/hda_intel.c
>>>> @@ -615,7 +615,7 @@ enum {
>>>>    /* quirks for Nvidia */
>>>>    #define AZX_DCAPS_PRESET_NVIDIA \
>>>>        (AZX_DCAPS_NVIDIA_SNOOP | AZX_DCAPS_RIRB_DELAY |
>>>> AZX_DCAPS_NO_MSI |\
>>>> -     AZX_DCAPS_ALIGN_BUFSIZE)
>>>> +     AZX_DCAPS_ALIGN_BUFSIZE | AZX_DCAPS_NO_64BIT)
>>>>
>>>>    #define AZX_DCAPS_PRESET_CTHDA \
>>>>        (AZX_DCAPS_NO_MSI | AZX_DCAPS_POSFIX_LPIB |
>>>> AZX_DCAPS_4K_BDLE_BOUNDARY)
>>>>
>>>
>>>
>>>
>>
> 
> 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/