linux-kernel - Re: dmapool regression in next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181207091038.4c1ce190@canb.auug.org.au>
Date:   Fri, 7 Dec 2018 09:10:38 +1100
From:   Stephen Rothwell <sfr@...b.auug.org.au>
To:     Tony Lindgren <tony@...mide.com>
Cc:     Tony Battersby <tonyb@...ernetics.com>,
        Robin Murphy <robin.murphy@....com>,
        Krzysztof Kozlowski <krzk@...nel.org>,
        akpm@...ux-foundation.org, john.garry@...wei.com,
        linux@...linux.org.uk, linux-kernel@...r.kernel.org,
        andy.shevchenko@...il.com, linux-omap@...r.kernel.org, hch@....de,
        linux-arm-kernel@...ts.infradead.org,
        Marek Szyprowski <m.szyprowski@...sung.com>,
        Matthew Wilcox <willy@...radead.org>
Subject: Re: dmapool regression in next

Hi all,

On Thu, 6 Dec 2018 08:33:15 -0800 Tony Lindgren <tony@...mide.com> wrote:
>
> * Tony Battersby <tonyb@...ernetics.com> [181206 16:13]:
> > On 12/6/18 10:51 AM, Robin Murphy wrote:  
> > >> Here is the prototype:
> > >>
> > >> void dma_pool_free(struct dma_pool *pool, void *vaddr, dma_addr_t dma);
> > >>
> > >> With the old code, the 'dma' value had to be correct for use with
> > >> pool_find_page(), or else you would get an error.  If the 'vaddr' value
> > >> was incorrect, it would corrupt the dmapool freelist, but you wouldn't
> > >> get an error unless DMAPOOL_DEBUG was enabled.
> > >>
> > >> With my patch applied, 'vaddr' has to be correct for virt_to_page().  My
> > >> code also checks that 'dma' is consistent with 'vaddr' even if
> > >> DMAPOOL_DEBUG is disabled, since the check is fast and it will prevent
> > >> problems like this in the future.  
> > > Unfortunately that logic has a fatal flaw - DMA pools are backed by 
> > > dma_alloc_coherent(), and there is absolutely no guarantee that the 
> > > memory dma_alloc_coherent() returns is backed by a struct page at all. 
> > > Even if it is, there is still absolutely no guarantee that the vaddr 
> > > value it returns is valid for virt_to_page() - on many systems it will 
> > > be in vmalloc or some architecture-specific region of address space.
> > >
> > > The problem is not that these drivers are buggy (they're not - the arch 
> > > code is returning a vmalloc()ed non-cacheable remap in the first place), 
> > > it's that 26abe88e830d is fundamentally unworkable and needs reverting. 
> > > Apparently the original patches managed not to catch my eye as something 
> > > I needed to review, sorry about that :(
> > >
> > > Robin.
> > >  
> > Thanks for the info; the inner workings of the vm system are a bit out
> > of my area of expertise.  My first version of the patch series used a
> > different method that didn't rely on virt_to_page(); I will go back to
> > that version, clean it up, and resubmit when I have time.
> > 
> > Andrew, please revert all 9 patches.  I will resubmit the set when I
> > have a workable solution.  
> 
> OK sounds good to me. I can test the new set easily when available
> if you Cc me on them.

I have removed those patches from linux-next for today.

-- 
Cheers,
Stephen Rothwell

Content of type "application/pgp-signature" skipped