linux-kernel - Re: Issue seen since commit f5ff79fddf0e ("dma-mapping: remove CONFIG_DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221011064010.GA3646@lst.de>
Date:   Tue, 11 Oct 2022 08:40:10 +0200
From:   Christoph Hellwig <hch@....de>
To:     Jerry Snitselaar <jsnitsel@...hat.com>
Cc:     Christoph Hellwig <hch@....de>,
        Robin Murphy <robin.murphy@....com>,
        Joerg Roedel <joro@...tes.org>, iommu@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: Issue seen since commit f5ff79fddf0e ("dma-mapping: remove
 CONFIG_DMA_REMAP")

On Mon, Oct 10, 2022 at 11:57:39AM -0700, Jerry Snitselaar wrote:
> I still need to grab a system and try to see what it is doing on the
> subsequent shutdowns, because it seems to me that any time
> bnx2fc_free_session_resc() is called it will end up there, unless the
> allocs are not coming from vmalloc() in the later boots. Between the
> comments in dma_free_attrs(), and preempt.h, dma_free_coherent()
> shouldn't be called under a spin_lock_bh(), yes?

It shouldn't.  And you would have seen the same BUG_ON on many non-x86
architectures even beforethe commit..

> I think the comments
> in dma_free_attrs() might be out of date with commit f5ff79fddf0e
> ("dma-mapping: remove CONFIG_DMA_REMAP") in place since now it is more
> general that you can land in vunmap().

Yes, the comment has always been a bit too specific, and is even more
so now.

> Also, should that WARN_ON() in
> dma_free_attrs() trigger as well for the BH disabled case?

Probably.  And we should probably early return in that case to "just"
leak the memory instead of crashing the kernel when called from a buggy
driver.