linux-kernel - Re: [PATCH] i2c: i2c-qcom-geni: Properly handle DMA safe buffers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Sep 2018 11:25:04 -0700
From:   Stephen Boyd <swboyd@...omium.org>
To:     Wolfram Sang <wsa@...-dreams.de>
Cc:     linux-kernel@...r.kernel.org, linux-i2c@...r.kernel.org,
        linux-arm-msm@...r.kernel.org,
        Karthikeyan Ramasubramanian <kramasub@...eaurora.org>,
        Sagar Dharia <sdharia@...eaurora.org>,
        Girish Mahadevan <girishm@...eaurora.org>
Subject: Re: [PATCH] i2c: i2c-qcom-geni: Properly handle DMA safe buffers

Quoting Wolfram Sang (2018-09-18 15:16:46)
> 
> > This fixes a problem where the kernel oopses cleaning pages for a buffer
> > that's mapped into the vmalloc space. The pages are returned from
> > request_firmware() and passed down directly to the i2c master to write
> > to the i2c touchscreen device. Mapping vmalloc buffers with
> > dma_map_single() won't work reliably, causing an oops like below:
> 
> Exactly the reason why I implemented I2C_M_DMA_SAFE. Did you also notice
> the helper i2c_get_dma_safe_msg_buf() which you maybe could use for
> len > 32?
> 

Yes I noticed that after sending the patch, thanks for pointing it out.

But now when I try to use it I'm not exicted when the buffer is bounced
but we fail to map the buffer with the DMA APIs. For an I2C_M_RD
message, presumably we would call i2c_release_dma_safe_msg_buf() in this
error case, but that will cause the original buffer to be copied over
which seems wasteful to do, but I guess it's OK. I suppose we could have
another function like:

void i2c_release_dma_safe_msg_buf_on_err(struct i2c_msg *msg, u8 *buf)
{
        if (!buf || buf == msg->buf)
                return;

        kfree(buf);
}

so that we don't copy over the buffer on failure and still properly free
the buffer that we setup. Or we can pass an argument to
i2c_release_dma_safe_msg_buf() to indicate if we should do the memcpy or
not? Removing the I2C_M_RD flag from the message on failure doesn't
sound like a good idea.

Either way, I can resend the patch with the releasing and duplicate
memcpy and we can discuss this minor optimization.