linux-kernel - [BUG] crypto: qat: accessing the data mapped to streaming DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7bda4db1-cca2-f6f1-4b70-52d2d25f8d2d@tsinghua.edu.cn>
Date:   Sun, 2 Aug 2020 22:35:59 +0800
From:   Jia-Ju Bai <baijiaju@...nghua.edu.cn>
To:     giovanni.cabiddu@...el.com, herbert@...dor.apana.org.au,
        davem@...emloft.net, ardb@...nel.org, horia.geanta@....com,
        geert+renesas@...der.be, ebiggers@...gle.com
Cc:     qat-linux@...el.com, linux-crypto@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [BUG] crypto: qat: accessing the data mapped to streaming DMA

In qat_alg_sgl_to_bufl(), "bufl" and "buflout" are mapped to streaming DMA:
   blp = dma_map_single(dev, bufl, sz, DMA_TO_DEVICE);
   bloutp = dma_map_single(dev, buflout, sz_out, DMA_TO_DEVICE);

Then "bufl" and "buflout" are accessed at some places, such as:
   bufl->bufers[y].len = sg->length;
   bufl->num_bufs = sg_nctr;
   bufers = buflout->bufers;
   buflout->num_bufs = sg_nctr;

These accesses may cause data inconsistency between CPU cache and hardware.

I am not sure how to properly fix this problem, and thus I only report it.


Best wishes,
Jia-Ju Bai