linux-kernel - Re: [PATCHv2 09/11] dmapool: simplify freeing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 27 Dec 2022 13:21:32 -0700
From:   Keith Busch <kbusch@...nel.org>
To:     Christoph Hellwig <hch@...radead.org>
Cc:     Keith Busch <kbusch@...a.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, Matthew Wilcox <willy@...radead.org>,
        Tony Battersby <tonyb@...ernetics.com>,
        Kernel Team <kernel-team@...a.com>
Subject: Re: [PATCHv2 09/11] dmapool: simplify freeing

On Fri, Dec 23, 2022 at 08:38:55AM -0800, Christoph Hellwig wrote:
> > @@ -280,14 +268,14 @@ void dma_pool_destroy(struct dma_pool *pool)
> >  	mutex_unlock(&pools_reg_lock);
> >  
> >  	list_for_each_entry_safe(page, tmp, &pool->page_list, page_list) {
> > +		if (!is_page_busy(page))
> > +			dma_free_coherent(pool->dev, pool->allocation,
> > +					  page->vaddr, page->dma);
> > +		else
> >  			dev_err(pool->dev, "%s %s, %p busy\n", __func__,
> >  				pool->name, page->vaddr);
> > +		list_del(&page->page_list);
> > +		kfree(page);
> 
> Hmm.  The is_page_busy case is really a should not happen case.
> What is the benefit of skipping the dma_free_coherent and leaking
> memory here, vs letting KASAN and friends see the free and possibly
> help with debugging?  In other words, why is this not:
> 
> 		WARN_ON_ONCE(is_page_busy(page));
> 		dma_free_coherent(pool->dev, pool->allocation, page->vaddr,
> 				  page->dma);
> 		...

The memory is presumed to still be owned by the device in this case, so
the kernel shouldn't free it. I don't think KASAN will be very helpful
if the device corrupts memory.
 
> >  	page->in_use--;
> >  	*(int *)vaddr = page->offset;
> >  	page->offset = offset;
> > -	/*
> > -	 * Resist a temptation to do
> > -	 *    if (!is_page_busy(page)) pool_free_page(pool, page);
> > -	 * Better have a few empty pages hang around.
> > -	 */
> 
> This doesn't look related to the rest, or am I missing something?

Oops, this was supposed to go with a later patch in this series that
removed "is_page_busy()".