linux-kernel - [PATCH] drm/ttm: properly unmap dma page upon failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190325202250.212801-1-yuzhao@google.com>
Date:   Mon, 25 Mar 2019 14:22:50 -0600
From:   Yu Zhao <yuzhao@...gle.com>
To:     Christian Koenig <christian.koenig@....com>,
        Huang Rui <ray.huang@....com>,
        Junwei Zhang <Jerry.Zhang@....com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>
Cc:     dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        Yu Zhao <yuzhao@...gle.com>
Subject: [PATCH] drm/ttm: properly unmap dma page upon failure

dma_unmap_page() must be called with exactly the same dma address
and size returned by dma_map_page(). Otherwise, the function may
fail.

This is at least the case for debug_dma_unmap_page() and AMD iommu
unmap_page callback.

Signed-off-by: Yu Zhao <yuzhao@...gle.com>
---
 drivers/gpu/drm/ttm/ttm_page_alloc.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index f841accc2c00..c1636595f63c 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -1118,10 +1118,19 @@ int ttm_populate_and_map_pages(struct device *dev, struct ttm_dma_tt *tt,
 						  0, num_pages * PAGE_SIZE,
 						  DMA_BIDIRECTIONAL);
 		if (dma_mapping_error(dev, tt->dma_address[i])) {
+			num_pages = 1;
 			while (i--) {
+				if (i && tt->ttm.pages[i] -
+					 tt->ttm.pages[i - 1] == 1) {
+					tt->dma_address[i] = 0;
+					num_pages++;
+					continue;
+				}
 				dma_unmap_page(dev, tt->dma_address[i],
-					       PAGE_SIZE, DMA_BIDIRECTIONAL);
+					       num_pages * PAGE_SIZE,
+					       DMA_BIDIRECTIONAL);
 				tt->dma_address[i] = 0;
+				num_pages = 1;
 			}
 			ttm_pool_unpopulate(&tt->ttm);
 			return -EFAULT;
-- 
2.21.0.392.gf8f6787159e-goog