linux-kernel - 回复: [PATCH V1] dma-mapping: Set dma_mem pointer as NULL after it's freed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <SEYPR06MB62783EBAE40527D140F29B04828EA@SEYPR06MB6278.apcprd06.prod.outlook.com>
Date:   Tue, 12 Dec 2023 14:30:12 +0000
From:   "Joakim  Zhang" <joakim.zhang@...tech.com>
To:     "hch@....de" <hch@....de>,
        "m.szyprowski@...sung.com" <m.szyprowski@...sung.com>,
        "robin.murphy@....com" <robin.murphy@....com>
CC:     "iommu@...ts.linux.dev" <iommu@...ts.linux.dev>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        cix-kernel-upstream <cix-kernel-upstream@...tech.com>
Subject: 回复: [PATCH V1] dma-mapping: Set dma_mem pointer as NULL after it's freed


Hi maintainers,

> -----邮件原件-----
> 发件人: Joakim Zhang <joakim.zhang@...tech.com>
> 发送时间: 2023年12月12日 13:22
> 收件人: hch@....de; m.szyprowski@...sung.com; robin.murphy@....com
> 抄送: iommu@...ts.linux.dev; linux-kernel@...r.kernel.org;
> cix-kernel-upstream <cix-kernel-upstream@...tech.com>; Joakim Zhang
> <joakim.zhang@...tech.com>
> 主题: [PATCH V1] dma-mapping: Set dma_mem pointer as NULL after it's freed
> 
> From: Joakim Zhang <joakim.zhang@...tech.com>
> 
> Reproduced with below sequence:
> dma_declare_coherent_memory()->dma_release_coherent_memory()
> ->dma_declare_coherent_memory()->"return -EBUSY" error
> 
> It will return -EBUSY from the dma_assign_coherent_memory() in
> dma_declare_coherent_memory(), the reason is that dev->dma_mem pointer
> has not been set to NULL after it's freed.
> 
> Go through the driver, found there is a issue in rmem_dma_device_release(),
> the reserved memory has not been freed before "dev->dma_mem = NULL;". So
> if user call of_reserved_mem_device_release(), will not free reserved mem in
> fact.
> 
> Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to
> kernel/dma")
> Signed-off-by: Joakim Zhang <joakim.zhang@...tech.com>
> ---
>  kernel/dma/coherent.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c index
> c21abc77c53e..602e055fc1bf 100644
> --- a/kernel/dma/coherent.c
> +++ b/kernel/dma/coherent.c
> @@ -132,8 +132,10 @@ int dma_declare_coherent_memory(struct device
> *dev, phys_addr_t phys_addr,
> 
>  void dma_release_coherent_memory(struct device *dev)  {
> -	if (dev)
> +	if (dev) {
>  		_dma_release_coherent_memory(dev->dma_mem);
> +		dev->dma_mem = NULL;
> +	}
>  }
> 
>  static void *__dma_alloc_from_coherent(struct device *dev, @@ -349,8
> +351,10 @@ static int rmem_dma_device_init(struct reserved_mem *rmem,
> struct device *dev)  static void rmem_dma_device_release(struct
> reserved_mem *rmem,
>  				    struct device *dev)
>  {
> -	if (dev)
> +	if (dev) {
> +		_dma_release_coherent_memory(rmem->priv);

Per my understanding, this change may not need, since this is reserved memory from device tree, once calling of_reserved_mem_device_init_by_idx() to initialize, it will be added to "of_rmem_assigned_device_list" list. Even calling of_reserved_mem_device_release() to release it, it's unnecessary to unremap and free it, since it's "reserved memory", only need to unbind from the device. When we call of_reserved_mem_device_init_by_idx() again, just need to find it from the list then bind it.

Right?

Joakim

>  		dev->dma_mem = NULL;
> +	}
>  }
> 
>  static const struct reserved_mem_ops rmem_dma_ops = {
> --
> 2.25.1