linux-kernel - Re: [PATCH v4 1/4] usb: dbc: early driver for xhci debug capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1611091015170.3501@nanos>
Date:   Wed, 9 Nov 2016 10:23:05 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Lu Baolu <baolu.lu@...ux.intel.com>
cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Mathias Nyman <mathias.nyman@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>, linux-usb@...r.kernel.org,
        x86@...nel.org, LKML <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH v4 1/4] usb: dbc: early driver for xhci debug
 capability

On Tue, 1 Nov 2016, Lu Baolu wrote:
> +static int __init xdbc_init(void)
> +{
...
> +	base = ioremap_nocache(xdbc.xhci_start, xdbc.xhci_length);
> +	if (!base) {
> +		xdbc_trace("failed to remap the io address\n");
> +		ret = -ENOMEM;
> +		goto free_and_quit;
> +	}
> +
> +	early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
> +	xdbc_trace("early mapped IO address released\n");
> +
> +	xdbc.xhci_base = base;
> +	offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
> +	xdbc.xdbc_reg = (struct xdbc_regs __iomem *)(xdbc.xhci_base + offset);

This is broken. What prevents that 

     - a printk is in progress on another cpu?

     - a printk happens between the unmap and storing the new base ?

Nothing AFAICT. So this needs to be done in a safe way. And just making it

	oldbase = xdbc.xhci_base;
	base = ioremap(....);
	xdbc.xhci_base = base;
	early_iounmap(oldbase);

does not work either because the compiler can rightfully cache
xdbc.xhci_base in the write related functions. The same issue with
xdbc.xdbc_reg.

Thanks,

	tglx