linux-kernel - Re: [PATCH] Revert "dma-contiguous: check for memory region overlap"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d2c93c6c-86d8-1a1f-e58c-8e9d29e9ddb0@arm.com>
Date:   Thu, 7 Sep 2023 09:57:02 +0100
From:   Robin Murphy <robin.murphy@....com>
To:     Zhenhua Huang <quic_zhenhuah@...cinc.com>, hch@....de,
        m.szyprowski@...sung.com
Cc:     iommu@...ts.linux.dev, linux-kernel@...r.kernel.org,
        quic_pkondeti@...cinc.com, quic_tingweiz@...cinc.com
Subject: Re: [PATCH] Revert "dma-contiguous: check for memory region overlap"

On 2023-09-07 09:03, Zhenhua Huang wrote:
> This reverts commit 3fa6456ebe13adab3ba1817c8e515a5b88f95dce.
> 
> The Commit broke the CMA region creation through DT on arm64,
> as showed below logs with "memblock=debug":
> [    0.000000] memblock_phys_alloc_range: 41943040 bytes align=0x200000
> from=0x0000000000000000 max_addr=0x00000000ffffffff
> early_init_dt_alloc_reserved_memory_arch+0x34/0xa0
> [    0.000000] memblock_reserve: [0x00000000fd600000-0x00000000ffdfffff]
> memblock_alloc_range_nid+0xc0/0x19c
> [    0.000000] Reserved memory: overlap with other memblock reserved region
> 
>  From call flow, region we defined in DT was always reserved before entering
> into rmem_cma_setup. Also, rmem_cma_setup has one routine cma_init_reserved_mem
> to ensure the region was reserved. Checking the region not reserved here seems
> not correct.
> 
> early_init_fdt_scan_reserved_mem:
>      fdt_scan_reserved_mem
>          __reserved_mem_reserve_reg
> 		early_init_dt_reserve_memory
> 			memblock_reserve(using “reg” prop case)
>          fdt_init_reserved_mem
> 		__reserved_mem_alloc_size
> 			*early_init_dt_alloc_reserved_memory_arch*
> 				memblock_reserve(dynamic alloc case)
>          __reserved_mem_init_node
> 		rmem_cma_setup(region overlap check here should always fail)
> 
> Example DT can be used to reproduce issue:
> 
>      dump_mem: mem_dump_region {
>              compatible = "shared-dma-pool";
>              alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
>              reusable;
>              size = <0 0x2800000>;
>      };
> 
> Signed-off-by: Zhenhua Huang <quic_zhenhuah@...cinc.com>
> ---
>   kernel/dma/contiguous.c | 5 -----
>   1 file changed, 5 deletions(-)
> 
> diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
> index 88c595e..f005c66 100644
> --- a/kernel/dma/contiguous.c
> +++ b/kernel/dma/contiguous.c
> @@ -473,11 +473,6 @@ static int __init rmem_cma_setup(struct reserved_mem *rmem)
>   		return -EBUSY;
>   	}
>   
> -	if (memblock_is_region_reserved(rmem->base, rmem->size)) {
> -		pr_info("Reserved memory: overlap with other memblock reserved region\n");
> -		return -EBUSY;
> -	}

Um, indeed... failing to process a reserved memory region if it is 
reserved is clearly nonsensical. I mean, a few steps later we reach 
cma_init_reserved_mem() which already relies on the exact opposite check:

	if (!size || !memblock_is_region_reserved(base, size))
		return -EINVAL;

There's no way 3fa6456ebe13 could have worked or been properly tested :/

Thanks,
Robin.

> -
>   	if (!of_get_flat_dt_prop(node, "reusable", NULL) ||
>   	    of_get_flat_dt_prop(node, "no-map", NULL))
>   		return -EINVAL;