netdev - Re: [PATCH] net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20191209.142653.1925547187942224188.davem@davemloft.net>
Date:   Mon, 09 Dec 2019 14:26:53 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     grygorii.strashko@...com
Cc:     netdev@...r.kernel.org, ivan.khoronzhuk@...aro.org, nsekhar@...com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: ethernet: ti: davinci_cpdma: fix warning "device
 driver frees DMA memory with different size"

From: Grygorii Strashko <grygorii.strashko@...com>
Date: Mon, 9 Dec 2019 13:19:24 +0200

> The TI CPSW(s) driver produces warning with DMA API debug options enabled:
> 
> WARNING: CPU: 0 PID: 1033 at kernel/dma/debug.c:1025 check_unmap+0x4a8/0x968
> DMA-API: cpsw 48484000.ethernet: device driver frees DMA memory with different size
>  [device address=0x00000000abc6aa02] [map size=64 bytes] [unmap size=42 bytes]
> CPU: 0 PID: 1033 Comm: ping Not tainted 5.3.0-dirty #41
> Hardware name: Generic DRA72X (Flattened Device Tree)
> [<c0112c60>] (unwind_backtrace) from [<c010d270>] (show_stack+0x10/0x14)
> [<c010d270>] (show_stack) from [<c09bc564>] (dump_stack+0xd8/0x110)
> [<c09bc564>] (dump_stack) from [<c013b93c>] (__warn+0xe0/0x10c)
> [<c013b93c>] (__warn) from [<c013b9ac>] (warn_slowpath_fmt+0x44/0x6c)
> [<c013b9ac>] (warn_slowpath_fmt) from [<c01e0368>] (check_unmap+0x4a8/0x968)
> [<c01e0368>] (check_unmap) from [<c01e08a8>] (debug_dma_unmap_page+0x80/0x90)
> [<c01e08a8>] (debug_dma_unmap_page) from [<c0752414>] (__cpdma_chan_free+0x114/0x16c)
> [<c0752414>] (__cpdma_chan_free) from [<c07525c4>] (__cpdma_chan_process+0x158/0x17c)
> [<c07525c4>] (__cpdma_chan_process) from [<c0753690>] (cpdma_chan_process+0x3c/0x5c)
> [<c0753690>] (cpdma_chan_process) from [<c0758660>] (cpsw_tx_mq_poll+0x48/0x94)
> [<c0758660>] (cpsw_tx_mq_poll) from [<c0803018>] (net_rx_action+0x108/0x4e4)
> [<c0803018>] (net_rx_action) from [<c010230c>] (__do_softirq+0xec/0x598)
> [<c010230c>] (__do_softirq) from [<c0143914>] (do_softirq.part.4+0x68/0x74)
> [<c0143914>] (do_softirq.part.4) from [<c0143a44>] (__local_bh_enable_ip+0x124/0x17c)
> [<c0143a44>] (__local_bh_enable_ip) from [<c0871590>] (ip_finish_output2+0x294/0xb7c)
> [<c0871590>] (ip_finish_output2) from [<c0875440>] (ip_output+0x210/0x364)
> [<c0875440>] (ip_output) from [<c0875e2c>] (ip_send_skb+0x1c/0xf8)
> [<c0875e2c>] (ip_send_skb) from [<c08a7fd4>] (raw_sendmsg+0x9a8/0xc74)
> [<c08a7fd4>] (raw_sendmsg) from [<c07d6b90>] (sock_sendmsg+0x14/0x24)
> [<c07d6b90>] (sock_sendmsg) from [<c07d8260>] (__sys_sendto+0xbc/0x100)
> [<c07d8260>] (__sys_sendto) from [<c01011ac>] (__sys_trace_return+0x0/0x14)
> Exception stack(0xea9a7fa8 to 0xea9a7ff0)
> ...
> 
> The reason is that cpdma_chan_submit_si() now stores original buffer length
> (sw_len) in CPDMA descriptor instead of adjusted buffer length (hw_len)
> used to map the buffer.
> 
> Hence, fix an issue by passing correct buffer length in CPDMA descriptor.
> 
> Cc: Ivan Khoronzhuk <ivan.khoronzhuk@...aro.org>
> Fixes: 6670acacd59e ("net: ethernet: ti: davinci_cpdma: add dma mapped submit")
> Signed-off-by: Grygorii Strashko <grygorii.strashko@...com>
> ---
> changes in v3:
>  - removed swlen local var

Applied and queued up for -stable, thanks.