linux-kernel - Re: [PATCH 1/2] Revert "udmabuf: fix vmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b077248e-8af5-46be-89a5-100da3ca35ba@vivo.com>
Date: Mon, 28 Apr 2025 15:03:01 +0800
From: Huan Yang <link@...o.com>
To: "Kasireddy, Vivek" <vivek.kasireddy@...el.com>,
 Sumit Semwal <sumit.semwal@...aro.org>,
 Christian König <christian.koenig@....com>,
 Gerd Hoffmann <kraxel@...hat.com>, Andrew Morton
 <akpm@...ux-foundation.org>, Dave Airlie <airlied@...hat.com>,
 "linux-media@...r.kernel.org" <linux-media@...r.kernel.org>,
 "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
 "linaro-mm-sig@...ts.linaro.org" <linaro-mm-sig@...ts.linaro.org>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc: "opensource.kernel@...o.com" <opensource.kernel@...o.com>,
 Bingbu Cao <bingbu.cao@...ux.intel.com>
Subject: Re: [PATCH 1/2] Revert "udmabuf: fix vmap_udmabuf error page set"


在 2025/4/28 12:16, Kasireddy, Vivek 写道:
> Hi Huan,
>
>> Subject: Re: [PATCH 1/2] Revert "udmabuf: fix vmap_udmabuf error page set"
>>
>>   From 38aa11d92f209e7529736f3e11e08dfc804bdfae Mon Sep 17 00:00:00
>> 2001
>> From: Huan Yang <link@...o.com>
>> Date: Tue, 15 Apr 2025 10:04:18 +0800
>> Subject: [PATCH 1/2] Revert "udmabuf: fix vmap_udmabuf error page set"
>>
>> This reverts commit 18d7de823b7150344d242c3677e65d68c5271b04.
>>
>> This given a misuse of vmap_pfn, vmap_pfn give a !pfn_valid check
>> to avoid user miss use it. This API design to only for none-page struct
>> based user invoke, i.e. PCIe BARs and other. So any page based will
>> inject by !pfn_valid check.
>>
>> udmabuf used shmem or hugetlb as folio src, hence, page/folio based,
>> can't use it.
> Please consider having a commit message like below and resend both patches:
> "We cannot use vmap_pfn() in vmap_udmabuf() as it would fail the pfn_valid()
> check in vmap_pfn_apply(). This is because vmap_pfn() is intended to be
> used for mapping non-struct-page memory such as PCIe BARs. Since, udmabuf
> mostly works with pages/folios backed by shmem/hugetlbfs/THP, vmap_pfn()
> is not the right tool or API to invoke for implementing vmap."

Thanks, that's clearer, I'll update in v2 version. :)

Huan

>
> Thanks,
> Vivek
>
>> Signed-off-by: Huan Yang <link@...o.com>
>> Reported-by: Bingbu Cao <bingbu.cao@...ux.intel.com>
>> Closes: https://lore.kernel.org/dri-devel/eb7e0137-3508-4287-98c4-
>> 816c5fd98e10@...o.com/T/#mbda4f64a3532b32e061f4e8763bc8e307bea3ca
>> 8
>> Acked-by: Vivek Kasireddy <vivek.kasireddy@...el.com>
>> ---
>>    drivers/dma-buf/Kconfig   |  1 -
>>    drivers/dma-buf/udmabuf.c | 22 +++++++---------------
>>    2 files changed, 7 insertions(+), 16 deletions(-)
>>
>> diff --git a/drivers/dma-buf/Kconfig b/drivers/dma-buf/Kconfig
>> index fee04fdb0822..b46eb8a552d7 100644
>> --- a/drivers/dma-buf/Kconfig
>> +++ b/drivers/dma-buf/Kconfig
>> @@ -36,7 +36,6 @@ config UDMABUF
>>        depends on DMA_SHARED_BUFFER
>>        depends on MEMFD_CREATE || COMPILE_TEST
>>        depends on MMU
>> -    select VMAP_PFN
>>        help
>>          A driver to let userspace turn memfd regions into dma-bufs.
>>          Qemu can use this to create host dmabufs for guest framebuffers.
>> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
>> index 7eee3eb47a8e..79845565089d 100644
>> --- a/drivers/dma-buf/udmabuf.c
>> +++ b/drivers/dma-buf/udmabuf.c
>> @@ -109,29 +109,21 @@ static int mmap_udmabuf(struct dma_buf *buf,
>> struct vm_area_struct *vma)
>>    static int vmap_udmabuf(struct dma_buf *buf, struct iosys_map *map)
>>    {
>>        struct udmabuf *ubuf = buf->priv;
>> -    unsigned long *pfns;
>> +    struct page **pages;
>>        void *vaddr;
>>        pgoff_t pg;
>>
>>        dma_resv_assert_held(buf->resv);
>>
>> -    /**
>> -     * HVO may free tail pages, so just use pfn to map each folio
>> -     * into vmalloc area.
>> -     */
>> -    pfns = kvmalloc_array(ubuf->pagecount, sizeof(*pfns), GFP_KERNEL);
>> -    if (!pfns)
>> +    pages = kvmalloc_array(ubuf->pagecount, sizeof(*pages), GFP_KERNEL);
>> +    if (!pages)
>>            return -ENOMEM;
>>
>> -    for (pg = 0; pg < ubuf->pagecount; pg++) {
>> -        unsigned long pfn = folio_pfn(ubuf->folios[pg]);
>> -
>> -        pfn += ubuf->offsets[pg] >> PAGE_SHIFT;
>> -        pfns[pg] = pfn;
>> -    }
>> +    for (pg = 0; pg < ubuf->pagecount; pg++)
>> +        pages[pg] = &ubuf->folios[pg]->page;
>>
>> -    vaddr = vmap_pfn(pfns, ubuf->pagecount, PAGE_KERNEL);
>> -    kvfree(pfns);
>> +    vaddr = vm_map_ram(pages, ubuf->pagecount, -1);
>> +    kvfree(pages);
>>        if (!vaddr)
>>            return -EINVAL;
>>
>> --
>> 2.48.1
>>