linux-kernel - Re: [SHDCI] Heavy (thousands) DMA leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 5 Aug 2015 13:52:57 +0200
From:	Jiri Slaby <jslaby@...e.cz>
To:	Chen Bough <Haibo.Chen@...escale.com>
Cc:	Ulf Hansson <ulf.hansson@...aro.org>,
	"linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
	Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: [SHDCI] Heavy (thousands) DMA leaks

On 08/03/2015, 11:39 AM, Jiri Slaby wrote:
> Hi,
> 
> On 08/03/2015, 11:30 AM, Chen Bough wrote:
>> I carefully review my patch, all the DMA memory mapped in sdhci_pre_req() is unmapped in sdhci_post_req.
> 
> I suspect 'host_cookie' or 'next' handling is bad somewhere. But I don't
> know...
> 
>> Can you provide the method of your testing DMA leaks?
> 
> boot kernel with CONFIG_DMA_API_DEBUG
> insert the card
> mount it
> rsync from the card ~200 MB
> umount it
> unload the sdhci driver
> the leak warning is reported
> 
> I am not sure whether suspend-resume is needed after the first step.

No, it's not. This is sufficient:
boot kernel with CONFIG_DMA_API_DEBUG
insert the card
<no mounting, partition table read is enough>
remove the card
unload the sdhci driver
the leak warning is reported

>> You said over 4000 leaked mappings during one card transfer, if true, 
>> We can't map any dma memory after some sd transfer, do you meet this?
> 
> Yes, I see:
> sdhci-pci 0000:02:00.0: swiotlb buffer is full (sz: 65536 bytes)
> after some time. The driver falls back to non-DMA transfers after that.
> It also generates a warning about that:
> WARNING: CPU: 0 PID: 0 at drivers/mmc/host/sdhci.c:857
> sdhci_prepare_data+0x8ec/0x900 [sdhci]()

I am attaching a debug patch and a debug log. You can see where
0x00000000fffb0000 and 0x00000000fffe0000 is leaked. It is when 'invalid
cookie' error happens.

regards,
-- 
js
suse labs

View attachment "bad_dma" of type "text/plain" (30960 bytes)

Download attachment "debug.patch" of type "application/mbox" (2473 bytes)