linux-kernel - Re: [PATCH v2] net: stmmac: allocate separate page for buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240911165140.566d9fdb@kernel.org>
Date: Wed, 11 Sep 2024 16:51:40 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Suraj Jaiswal <quic_jsuraj@...cinc.com>
Cc: Alexandre Torgue <alexandre.torgue@...s.st.com>, Jose Abreu
 <joabreu@...opsys.com>, "David S. Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, Maxime
 Coquelin <mcoquelin.stm32@...il.com>, <netdev@...r.kernel.org>,
 <linux-stm32@...md-mailman.stormreply.com>,
 <linux-arm-kernel@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
 Prasad Sodagudi <psodagud@...cinc.com>, Andrew Halaney
 <ahalaney@...hat.com>, Rob Herring <robh@...nel.org>, <kernel@...cinc.com>
Subject: Re: [PATCH v2] net: stmmac: allocate separate page for buffer

On Tue, 10 Sep 2024 18:18:41 +0530 Suraj Jaiswal wrote:
> Currently for TSO page is mapped with dma_map_single()
> and then resulting dma address is referenced (and offset)
> by multiple descriptors until the whole region is
> programmed into the descriptors.
> This makes it possible for stmmac_tx_clean() to dma_unmap()
> the first of the already processed descriptors, while the
> rest are still being processed by the DMA engine. This leads
> to an iommu fault due to the DMA engine using unmapped memory
> as seen below:
> 
> arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402,
> iova=0xfc401000, fsynr=0x60003, cbfrsynra=0x121, cb=38
> 
> Descriptor content:
>      TDES0       TDES1   TDES2   TDES3
> 317: 0xfc400800  0x0     0x36    0xa02c0b68
> 318: 0xfc400836  0x0     0xb68   0x90000000
> 
> As we can see above descriptor 317 holding a page address
> and 318 holding the buffer address by adding offset to page
> addess. Now if 317 descritor is cleaned as part of tx_clean()
> then we will get SMMU fault if 318 descriptor is getting accessed.

The device is completing earlier chunks of the payload before the entire
payload is sent? That's very unusual, is there a manual you can quote
on this?

> To fix this, let's map each descriptor's memory reference individually.
> This way there's no risk of unmapping a region that's still being
> referenced by the DMA engine in a later descriptor.

This adds overhead. Why not wait with unmapping until the full skb is
done? Presumably you can't free half an skb, anyway.

Please added Fixes tag and use "PATCH net" as the subject tag/prefix.
-- 
pw-bot: cr