linux-kernel - Re: [PATCH] staging: android: ion: Set the length of the DMA sg entries in buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Jan 2016 09:39:02 -0800
From:	Laura Abbott <labbott@...hat.com>
To:	"Jon Medhurst (Tixy)" <tixy@...aro.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Arve Hjønnevåg <arve@...roid.com>,
	Riley Andrews <riandrews@...roid.com>
Cc:	Liviu Dudau <Liviu.Dudau@....com>, devel@...verdev.osuosl.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: android: ion: Set the length of the DMA sg
 entries in buffer

On 01/21/2016 03:57 AM, Jon Medhurst (Tixy) wrote:
> From: Liviu Dudau <Liviu.Dudau@....com>
>
> ion_buffer_create() will allocate a buffer and then create a DMA
> mapping for it, but it forgot to set the length of the page entries.
>
> Signed-off-by: Liviu Dudau <Liviu.Dudau@....com>
> Signed-off-by: Jon Medhurst <tixy@...aro.org>
> ---
>   drivers/staging/android/ion/ion.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
> index e237e9f..df56021 100644
> --- a/drivers/staging/android/ion/ion.c
> +++ b/drivers/staging/android/ion/ion.c
> @@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
>   	 * memory coming from the heaps is ready for dma, ie if it has a
>   	 * cached mapping that mapping has been invalidated
>   	 */
> -	for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i)
> +	for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) {
>   		sg_dma_address(sg) = sg_phys(sg);
> +		sg_dma_len(sg) = sg->length;
> +	}
>   	mutex_lock(&dev->buffer_lock);
>   	ion_buffer_add(dev, buffer);
>   	mutex_unlock(&dev->buffer_lock);
>

So Ion is really doing it wrong by setting the sg_dma_address manually as
the comment above notes. Ion has moved away from sg_dma_len though
(see 06e0dcaeb4fd72a010a1f5ad0c03abd8e0a58ef9). This isn't technically
a mapping as well. What's broken by not having sg_dma_len set?

Thanks,
Laura