linux-kernel - Re: [PATCH] dell_rbu: stop abusing the DMA API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 2 Feb 2019 18:16:59 +0100
From:   Christoph Hellwig <hch@....de>
To:     Darren Hart <dvhart@...radead.org>
Cc:     Christoph Hellwig <hch@....de>, stuart.w.hayes@...il.com,
        andy@...radead.org, platform-driver-x86@...r.kernel.org,
        linux-kernel@...r.kernel.org, Mario_Limonciello@...l.com
Subject: Re: [PATCH] dell_rbu: stop abusing the DMA API

On Fri, Feb 01, 2019 at 03:15:59PM -0800, Darren Hart wrote:
> On Tue, Jan 29, 2019 at 08:34:09AM +0100, Christoph Hellwig wrote:
> > For some odd reason dell_rbu actually seems to want the physical and
> > not a bus address for the allocated buffer.  Lets assume that actually
> > is correct given that it is BIOS-related and that is a good source
> > of insanity.  In that case we should not use dma_alloc_coherent with
> > a NULL device to allocate memory, but use GFP_DMA32 to stay under
> > the 32-bit BIOS limit.
> 
> + Mario re bios related physical address - is Christoph's assumption
> correct?
> 
> Christoph, did you observe a failure? If so, we should probably also
> tag for stable.

No, I've been auditing for DMA API (ab-)users that don't pass a
struct device.  Generally the fix was to just pass a struct device
that is easily available.  But dell_rbu doesn't actually seem to
be a "device" in the traditional sense, and the way it uses the
DMA API is really, really odd - it first does a virt_to_phys on
memory allocated from the page allocator (so works with physical
addresses in that case) and the retries with a dma_alloc_coherent
with a NULL argument, which in no way is guaranteed to you give
you something else, although for the current x86 implementation
will give you the equivalent of a GFP_DMA32 page allocator allocation
plus virt_to_phys.