linux-kernel - Re: [PATCH] swiotlb: Fix uninitialized pointer on DMA ops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 19 Aug 2018 08:57:31 -0400
From:   Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To:     Esteban Zamora <estebanzacr.20@...il.com>, estebanzacr.20@...il.com
CC:     Christoph Hellwig <hch@....de>,
        Marek Szyprowski <m.szyprowski@...sung.com>,
        Robin Murphy <robin.murphy@....com>,
        iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] swiotlb: Fix uninitialized pointer on DMA ops

On August 18, 2018 3:04:51 PM EDT, Esteban Zamora <estebanzacr.20@...il.com> wrote:
>The mmap function pointer on swiotlb_dma_ops struct is
>uninitialized, which causes a random crash when calling
>the dma_mmap_coherent function on platforms where no DMA
>address translation hardware is available.
>
>Set this pointer to NULL in order to fix the issue.


By default unused entries in .rodata structure (like this one) are zero - meaning they are NULL if not set by the complier.

You should be able to verify this by looking at the objdump of the kernel and find this structure.


>
>Signed-off-by: Esteban Zamora <estebanzacr.20@...il.com>
>---
> kernel/dma/swiotlb.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
>index 4f8a6db..9a7718c 100644
>--- a/kernel/dma/swiotlb.c
>+++ b/kernel/dma/swiotlb.c
>@@ -1082,5 +1082,6 @@ const struct dma_map_ops swiotlb_dma_ops = {
> 	.map_page		= swiotlb_map_page,
> 	.unmap_page		= swiotlb_unmap_page,
> 	.dma_supported		= dma_direct_supported,
>+	.mmap                   = NULL,
> };
> EXPORT_SYMBOL(swiotlb_dma_ops);