netdev - Re: [BUG] net: sungem: device driver frees DMA memory with wrong function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190102103141.GA15872@Red>
Date:   Wed, 2 Jan 2019 11:31:41 +0100
From:   Corentin Labbe <clabbe.montjoie@...il.com>
To:     Christoph Hellwig <hch@...radead.org>
Cc:     davem@...emloft.net, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [BUG] net: sungem: device driver frees DMA memory with wrong
 function

On Fri, Dec 28, 2018 at 12:36:21AM -0800, Christoph Hellwig wrote:
> Please try this patch:
> 

The error type change to "DMA-API: gem 0000:00:0f.0: device driver failed to check map error" (I will send patch for fixing this).
Note that I used the patch from your just sent DMA series (since the patch below is included in).

So you can add my
Tested-by: LABBE Corentin <clabbe.montjoie@...il.com>

Thanks

> diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
> index a52c6409bdc2..f454e0ed1398 100644
> --- a/include/linux/dma-mapping.h
> +++ b/include/linux/dma-mapping.h
> @@ -284,32 +284,25 @@ static inline void dma_direct_sync_sg_for_cpu(struct device *dev,
>  }
>  #endif
>  
> -static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr,
> -					      size_t size,
> -					      enum dma_data_direction dir,
> -					      unsigned long attrs)
> +static inline dma_addr_t dma_map_page_attrs(struct device *dev,
> +		struct page *page, size_t offset, size_t size,
> +		enum dma_data_direction dir, unsigned long attrs)
>  {
>  	const struct dma_map_ops *ops = get_dma_ops(dev);
>  	dma_addr_t addr;
>  
>  	BUG_ON(!valid_dma_direction(dir));
> -	debug_dma_map_single(dev, ptr, size);
>  	if (dma_is_direct(ops))
> -		addr = dma_direct_map_page(dev, virt_to_page(ptr),
> -				offset_in_page(ptr), size, dir, attrs);
> +		addr = dma_direct_map_page(dev, page, offset, size, dir, attrs);
>  	else
> -		addr = ops->map_page(dev, virt_to_page(ptr),
> -				offset_in_page(ptr), size, dir, attrs);
> -	debug_dma_map_page(dev, virt_to_page(ptr),
> -			   offset_in_page(ptr), size,
> -			   dir, addr, true);
> +		addr = ops->map_page(dev, page, offset, size, dir, attrs);
> +	debug_dma_map_page(dev, page, offset, size, dir, addr, false);
> +
>  	return addr;
>  }
>  
> -static inline void dma_unmap_single_attrs(struct device *dev, dma_addr_t addr,
> -					  size_t size,
> -					  enum dma_data_direction dir,
> -					  unsigned long attrs)
> +static inline void dma_unmap_page_attrs(struct device *dev, dma_addr_t addr,
> +		size_t size, enum dma_data_direction dir, unsigned long attrs)
>  {
>  	const struct dma_map_ops *ops = get_dma_ops(dev);
>  
> @@ -321,12 +314,6 @@ static inline void dma_unmap_single_attrs(struct device *dev, dma_addr_t addr,
>  	debug_dma_unmap_page(dev, addr, size, dir, true);
>  }
>  
> -static inline void dma_unmap_page_attrs(struct device *dev, dma_addr_t addr,
> -		size_t size, enum dma_data_direction dir, unsigned long attrs)
> -{
> -	return dma_unmap_single_attrs(dev, addr, size, dir, attrs);
> -}
> -
>  /*
>   * dma_maps_sg_attrs returns 0 on error and > 0 on success.
>   * It should never return a value < 0.
> @@ -363,25 +350,6 @@ static inline void dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sg
>  		ops->unmap_sg(dev, sg, nents, dir, attrs);
>  }
>  
> -static inline dma_addr_t dma_map_page_attrs(struct device *dev,
> -					    struct page *page,
> -					    size_t offset, size_t size,
> -					    enum dma_data_direction dir,
> -					    unsigned long attrs)
> -{
> -	const struct dma_map_ops *ops = get_dma_ops(dev);
> -	dma_addr_t addr;
> -
> -	BUG_ON(!valid_dma_direction(dir));
> -	if (dma_is_direct(ops))
> -		addr = dma_direct_map_page(dev, page, offset, size, dir, attrs);
> -	else
> -		addr = ops->map_page(dev, page, offset, size, dir, attrs);
> -	debug_dma_map_page(dev, page, offset, size, dir, addr, false);
> -
> -	return addr;
> -}
> -
>  static inline dma_addr_t dma_map_resource(struct device *dev,
>  					  phys_addr_t phys_addr,
>  					  size_t size,
> @@ -488,6 +456,19 @@ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
>  
>  }
>  
> +static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr,
> +		size_t size, enum dma_data_direction dir, unsigned long attrs)
> +{
> +	return dma_map_page_attrs(dev, virt_to_page(ptr), offset_in_page(ptr),
> +			size, dir, attrs);
> +}
> +
> +static inline void dma_unmap_single_attrs(struct device *dev, dma_addr_t addr,
> +		size_t size, enum dma_data_direction dir, unsigned long attrs)
> +{
> +	return dma_unmap_page_attrs(dev, addr, size, dir, attrs);
> +}
> +
>  #define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, 0)
>  #define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0)
>  #define dma_map_sg(d, s, n, r) dma_map_sg_attrs(d, s, n, r, 0)