linux-kernel - RE: [PATCH net-next] net: ipa: avoid 64-bit modulus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 24 Mar 2021 17:12:38 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Alex Elder' <elder@...e.org>, 'Alex Elder' <elder@...aro.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>
CC:     "rdunlap@...radead.org" <rdunlap@...radead.org>,
        "bjorn.andersson@...aro.org" <bjorn.andersson@...aro.org>,
        "evgreen@...omium.org" <evgreen@...omium.org>,
        "cpratapa@...eaurora.org" <cpratapa@...eaurora.org>,
        "subashab@...eaurora.org" <subashab@...eaurora.org>,
        "elder@...nel.org" <elder@...nel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH net-next] net: ipa: avoid 64-bit modulus

From: Alex Elder
> Sent: 24 March 2021 17:07
> 
> On 3/24/21 11:27 AM, David Laight wrote:
> > From: Alex Elder
> >> Sent: 23 March 2021 01:05
> >> It is possible for a 32 bit x86 build to use a 64 bit DMA address.
> >>
> >> There are two remaining spots where the IPA driver does a modulo
> >> operation to check alignment of a DMA address, and under certain
> >> conditions this can lead to a build error on i386 (at least).
> >>
> >> The alignment checks we're doing are for power-of-2 values, and this
> >> means the lower 32 bits of the DMA address can be used.  This ensures
> >> both operands to the modulo operator are 32 bits wide.
> >>
> >> Reported-by: Randy Dunlap <rdunlap@...radead.org>
> >> Signed-off-by: Alex Elder <elder@...aro.org>
> >> ---
> >>   drivers/net/ipa/gsi.c       | 11 +++++++----
> >>   drivers/net/ipa/ipa_table.c |  9 ++++++---
> >>   2 files changed, 13 insertions(+), 7 deletions(-)
> >>
> >> diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c
> >> index 7f3e338ca7a72..b6355827bf900 100644
> >> --- a/drivers/net/ipa/gsi.c
> >> +++ b/drivers/net/ipa/gsi.c
> >> @@ -1436,15 +1436,18 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32
> index)
> >>   /* Initialize a ring, including allocating DMA memory for its entries */
> >>   static int gsi_ring_alloc(struct gsi *gsi, struct gsi_ring *ring, u32 count)
> >>   {
> >> -	size_t size = count * GSI_RING_ELEMENT_SIZE;
> >> +	u32 size = count * GSI_RING_ELEMENT_SIZE;
> >>   	struct device *dev = gsi->dev;
> >>   	dma_addr_t addr;
> >>
> >> -	/* Hardware requires a 2^n ring size, with alignment equal to size */
> >> +	/* Hardware requires a 2^n ring size, with alignment equal to size.
> >> +	 * The size is a power of 2, so we can check alignment using just
> >> +	 * the bottom 32 bits for a DMA address of any size.
> >> +	 */
> >>   	ring->virt = dma_alloc_coherent(dev, size, &addr, GFP_KERNEL);
> >
> > Doesn't dma_alloc_coherent() guarantee that alignment?
> > I doubt anywhere else checks?
> 
> I normally wouldn't check something like this if it
> weren't guaranteed.  I'm not sure why I did it here.
> 
> I see it's "guaranteed to be aligned to the smallest
> PAGE_SIZE order which is greater than or equal to
> the requested size."  So I think the answer to your
> question is "yes, it does guarantee that."
> 
> I'll make a note to remove this check in a future
> patch, and will credit you with the suggestion.

I think 'count' is also required to be a power of 2.
so you could have checked 'addr & (size - 1)'.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)