linux-kernel - Re: [PATCH] firmware: qcom_scm: fix error for incompatible pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190722151234.GJ7234@tuxbook-pro>
Date:   Mon, 22 Jul 2019 08:12:34 -0700
From:   Bjorn Andersson <bjorn.andersson@...aro.org>
To:     Christoph Hellwig <hch@....de>
Cc:     Marc Gonzalez <marc.w.gonzalez@...e.fr>,
        Minwoo Im <minwoo.im.dev@...il.com>,
        MSM <linux-arm-msm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Andy Gross <agross@...nel.org>,
        Stanimir Varbanov <svarbanov@...sol.com>,
        Rob Clark <robdclark@...il.com>,
        Stephen Boyd <sboyd@...nel.org>
Subject: Re: [PATCH] firmware: qcom_scm: fix error for incompatible pointer

On Mon 22 Jul 02:30 PDT 2019, Christoph Hellwig wrote:

> On Mon, Jul 22, 2019 at 10:38:55AM +0200, Marc Gonzalez wrote:
> > > In file included from drivers/firmware/qcom_scm.c:12:0:
> > > ./include/linux/dma-mapping.h:636:21: note: expected ‘dma_addr_t * {aka long long unsigned int *}’ but argument is of type ‘phys_addr_t * {aka unsigned int *}’
> > >  static inline void *dma_alloc_coherent(struct device *dev, size_t size,
> > >                      ^~~~~~~~~~~~~~~~~~
> > > ```
> > > 
> > > We just can cast phys_addr_t to dma_addr_t here.
> > 
> > IME, casting is rarely a proper solution.
> 
> *nod*
> 
> ptr_phys probably should be a dma_addr_t.  Unless this driver is so
> magic that it really wants a physical and not a dma address, in which
> case it needs to use alloc_pages instead of dma_alloc_coherent
> and then call page_to_phys on the returned page, and a very big comment
> explaining why it is so special.

The scm call takes physical addresses (which happens to be 1:1 with DMA
addresses for this driver).

This allocation started off (downstream) as a simple kmalloc(), but
while the scm call is being executed an access from Linux will cause a
security violation (that's not handled gracefully). The properties of
dma_alloc is closer, so that's where the code is today.

Optimally this should be something like alloc_pages() and some mechanism
for unmapping the pages during the call. But no one has come up with a
suitable patch for that.

But there's a patch from Stephen for this already (not doing a
typecast).  Apparently I missed merging this, so I'll do that.

https://lore.kernel.org/linux-arm-msm/20190517210923.202131-2-swboyd@chromium.org/

Regards,
Bjorn