Message ID | 20230810091955.3579004-1-m.szyprowski@samsung.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b824:0:b0:3f2:4152:657d with SMTP id z4csp341516vqi; Thu, 10 Aug 2023 04:14:04 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHAvwa0Ui3iKTJLNnS1AkDNmT4ZmUR8L3naZSfOLnVg8kmY94o38GEtOSbzX97PJILdwLbj X-Received: by 2002:a05:6a00:23c6:b0:686:5f73:4eac with SMTP id g6-20020a056a0023c600b006865f734eacmr2928073pfc.13.1691666044307; Thu, 10 Aug 2023 04:14:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691666044; cv=none; d=google.com; s=arc-20160816; b=kYVkl0gbwqAiBWJsv8DNKxbhGEJMmj61Zi2o8+PGYJLpD4+67i238ac2uwSW6unFcF vgkFBkg8tDCdpffbet/Q7mkbZf8XSoKLkOxG+92Izg8zEoHNO7V5DkaKeuE5vqF1olzu bc9k7GGA6kp7rEpjmzO/WaszHAsO9Hq+aij0fmOITSkrXhaCdMS4Dd/wj/PtftYTk6M7 JxWMs+Oto4QymGWP9shaCHpenPXh0atz7qeQVeDJCRRlFx1BaFea8T1END1jlaKCj71v sYTZ8lY8Hbm4yQmAUmRz8gMNsKqXe4iNuDc9wiV26VG+RDoHZZzZzb7M3ogZhLi1+Gr2 OBuA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:cms-type:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature :dkim-filter; bh=QoClOrdI4RdByI00yXTFHg7j9E7DmiY7US96iwKAhaw=; fh=lUJYPoX6nwk7fo9JaX+26+3WTVy906URwanUSJ329aI=; b=eDzr3XqG0wZWofhCck1Sxx9FU2QWhAau7RIG2wwKqf5Dnj7WriEyVYkCj+qsTcjUhg wQ39LUb8zx5z/HMe8GwVDoKqobnTAY4+yi2cN+nwEHV5p2cUx71Dc/rlyeAGN9cHye4y Dz63eKsMwi3qF9TiJOWtqIomslpzi2VvHzWwe0tIyGMV6CMGtOhWypynv65Ow1nVQ0In g20bngTFB7qZPPV67ONyAL0PnndorERhOLxA7K9mfujrqFSKJypYOheiqQv/jhn0if97 w4iyS7Ers50beC7YmnkL7rVyU5U2xLIM+j5lnW2dZGcdR4+oqRMeVnwql10BdexNRpGZ /Hjg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@samsung.com header.s=mail20170921 header.b=No8kffyM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=samsung.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id cu7-20020a056a00448700b00686ea63778dsi1357934pfb.146.2023.08.10.04.13.50; Thu, 10 Aug 2023 04:14:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@samsung.com header.s=mail20170921 header.b=No8kffyM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=samsung.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234952AbjHJJV4 (ORCPT <rfc822;m15293943392@gmail.com> + 99 others); Thu, 10 Aug 2023 05:21:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51480 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234899AbjHJJVl (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 10 Aug 2023 05:21:41 -0400 Received: from mailout1.w1.samsung.com (mailout1.w1.samsung.com [210.118.77.11]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D7AC4232 for <linux-kernel@vger.kernel.org>; Thu, 10 Aug 2023 02:20:27 -0700 (PDT) Received: from eucas1p1.samsung.com (unknown [182.198.249.206]) by mailout1.w1.samsung.com (KnoxPortal) with ESMTP id 20230810092017euoutp011d9a381d9092dfee8366124c2e6c272e~5_xiIichd2589325893euoutp014 for <linux-kernel@vger.kernel.org>; Thu, 10 Aug 2023 09:20:17 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout1.w1.samsung.com 20230810092017euoutp011d9a381d9092dfee8366124c2e6c272e~5_xiIichd2589325893euoutp014 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1691659217; bh=QoClOrdI4RdByI00yXTFHg7j9E7DmiY7US96iwKAhaw=; h=From:To:Cc:Subject:Date:References:From; b=No8kffyMP8s/uzcC7VWFdYmmnTH7P0NcoRyPRUcGyT3Pu+rGmuo2IICzlkBn7yrQ+ WAjAcVBOcOC1Wzg928NF7JJAA5LpCUZWhvtE3MBkPUctHbaUQ5iXA856BglecJ18zV FGED3UoqIgDgLO8PM/75FFiwmC7Eg+8XHkKIdxK4= Received: from eusmges1new.samsung.com (unknown [203.254.199.242]) by eucas1p1.samsung.com (KnoxPortal) with ESMTP id 20230810092017eucas1p18efdff903fca3c7dcc6d86863914493b~5_xh6JbFA3218732187eucas1p1d; Thu, 10 Aug 2023 09:20:17 +0000 (GMT) Received: from eucas1p1.samsung.com ( [182.198.249.206]) by eusmges1new.samsung.com (EUCPMTA) with SMTP id 41.CE.42423.1DBA4D46; Thu, 10 Aug 2023 10:20:17 +0100 (BST) Received: from eusmtrp1.samsung.com (unknown [182.198.249.138]) by eucas1p2.samsung.com (KnoxPortal) with ESMTPA id 20230810092017eucas1p23930e5e5ec443ac7776002f2f09967d4~5_xhnoU-F2123221232eucas1p2n; Thu, 10 Aug 2023 09:20:17 +0000 (GMT) Received: from eusmgms1.samsung.com (unknown [182.198.249.179]) by eusmtrp1.samsung.com (KnoxPortal) with ESMTP id 20230810092017eusmtrp16964dd133a8fc6ce491f9c5b24516a77~5_xhmuQQl0594805948eusmtrp1s; Thu, 10 Aug 2023 09:20:17 +0000 (GMT) X-AuditID: cbfec7f2-a3bff7000002a5b7-4f-64d4abd1b7af Received: from eusmtip1.samsung.com ( [203.254.199.221]) by eusmgms1.samsung.com (EUCPMTA) with SMTP id 3B.9B.10549.1DBA4D46; Thu, 10 Aug 2023 10:20:17 +0100 (BST) Received: from AMDC4653.eu.corp.samsungelectronics.net (unknown [106.120.51.32]) by eusmtip1.samsung.com (KnoxPortal) with ESMTPA id 20230810092016eusmtip12c5ea43f9dd13ae1e5edbf6ed97f6bf3~5_xhHr2NS2978429784eusmtip1P; Thu, 10 Aug 2023 09:20:16 +0000 (GMT) From: Marek Szyprowski <m.szyprowski@samsung.com> To: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Marek Szyprowski <m.szyprowski@samsung.com>, Russell King <linux@armlinux.org.uk>, "Matthew Wilcox (Oracle)" <willy@infradead.org>, Andrew Morton <akpm@linux-foundation.org>, Mike Rapoport <rppt@kernel.org> Subject: [PATCH] arm: dma-mapping: don't call folio_next() beyond the requested region Date: Thu, 10 Aug 2023 11:19:55 +0200 Message-Id: <20230810091955.3579004-1-m.szyprowski@samsung.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFKsWRmVeSWpSXmKPExsWy7djPc7oXV19JMZiyW8Fizvo1bBabHl9j tbi8aw6bxaGpexkt1h65y25xZP12JovfP+awObB7XL52kdlj8wotj02rOtk8Tsz4zeKxeUm9 R9+WVYwenzfJBbBHcdmkpOZklqUW6dslcGXsPMdSsJqtom/fGvYGxumsXYycHBICJhJ7Jp5g 7mLk4hASWMEoseDlMTYI5wujxOxXjSwQzmdGiet7m+FaPl1eCdWynFFiw5kbLCAJIYFWJok3 5xhBbDYBQ4mut11sILaIgJvEjcYOJpAGZoFrjBLbd01iBkkIC0RIrPn4gx3EZhFQlZj8/S1Y M6+AvcT+SfdZILbJS+w/eJYZIi4ocXLmE7A4M1C8eetssCskBFZySKw6vI8JosFFYsK6XYwQ trDEq+Nb2CFsGYnTk3tYIBragT79fZ8JwpnAKNHw/BZUh7XEnXO/gO7mAFqhKbF+lz5E2FFi 18Y3YGEJAT6JG28FIY7gk5i0bTozRJhXoqNNCKJaTWLW8XVwaw9euMQMYXtIXPm6nB0SWLES yzpPMk5gVJiF5LVZSF6bhXDDAkbmVYziqaXFuempxYZ5qeV6xYm5xaV56XrJ+bmbGIHJ5/S/ 4592MM599VHvECMTB+MhRgkOZiURXtvgSylCvCmJlVWpRfnxRaU5qcWHGKU5WJTEebVtTyYL CaQnlqRmp6YWpBbBZJk4OKUamBTtnDaWGdyu/+9/SOp7YfvBzF16enV2i8+ocIn+K416F/NK ttrCfC2P9tFnV+L3qK6LmpuReP66sPGxJxLOyjvPv+z+tmul/4SVefGFOy/fPzlzvu38WO3j B01CmDsSYh9mz9kZ/J3n2obQlxHm+gt/f35//aPOe730Jm1OIavnT3teK3V/mR9VLlLBLu1o myx1SyRi2jGPqumZSsder8p5KbBJr/CKfNLKk1PtfNhj9pSpLUyYnzbl/IKsO6vYfNZ+bvtU UaR+6uLeEJk9AuzXl+gHP5X/cbbaQrdjxmP7d3fudvPss2P0nff661ah9U7JhXovI5o39/To /onrvXR5/gm/5dOvVDm7N2mdeqnEUpyRaKjFXFScCABFn4BErQMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrALMWRmVeSWpSXmKPExsVy+t/xu7oXV19JMfj8mtNizvo1bBabHl9j tbi8aw6bxaGpexkt1h65y25xZP12JovfP+awObB7XL52kdlj8wotj02rOtk8Tsz4zeKxeUm9 R9+WVYwenzfJBbBH6dkU5ZeWpCpk5BeX2CpFG1oY6RlaWugZmVjqGRqbx1oZmSrp29mkpOZk lqUW6dsl6GXsPMdSsJqtom/fGvYGxumsXYycHBICJhKfLq9k7mLk4hASWMooceTgSyaIhIzE yWkNUEXCEn+udbFBFDUzSUy9up4NJMEmYCjR9bYLzBYR8JBo+3cPbBKzwC1GiQnb37GDJIQF wiQ+/HkINpVFQFVi8ve3jCA2r4C9xP5J91kgNshL7D94lhkiLihxcuYTsDgzULx562zmCYx8 s5CkZiFJLWBkWsUoklpanJueW2yoV5yYW1yal66XnJ+7iREY9NuO/dy8g3Heq496hxiZOBgP MUpwMCuJ8NoGX0oR4k1JrKxKLcqPLyrNSS0+xGgKdN9EZinR5Hxg3OWVxBuaGZgamphZGpha mhkrifN6FnQkCgmkJ5akZqemFqQWwfQxcXBKNTBVmHRuN1HYtD/lRGexmZnk0uQZMnHHfkx/ fc/0zSrrPfd+ejPua1+//5e1UcQryS+bzhjoRKYyNdk/uji/IfDcCzMG9WnTTuzRSVNKVpuz ZOI5sbX+1ofNcu5dvFAozzh/CuvLYE4zfacvR5//bygJSlunpRIrfUY+rUw/ZUf5ixrfJK0H k1cmb7tR5ie6MebYo6oGbdZ1113+hu6V7AgW6dc4t1fjo5Jb3IRLN7aKGu+dsNb5R//aPPsX d2epmGprfAhaUmg17YU6C2uVwt+2rYnMbhOvhJos+qiaaibP4ZdsutH5kml8r5lUx40ZkfeX hdYVy9lp8S2+ssYq3kdnx4PYo1s0ZJYuDxQ71KvEUpyRaKjFXFScCACv2/22AwMAAA== X-CMS-MailID: 20230810092017eucas1p23930e5e5ec443ac7776002f2f09967d4 X-Msg-Generator: CA Content-Type: text/plain; charset="utf-8" X-RootMTR: 20230810092017eucas1p23930e5e5ec443ac7776002f2f09967d4 X-EPHeader: CA CMS-TYPE: 201P X-CMS-RootMailID: 20230810092017eucas1p23930e5e5ec443ac7776002f2f09967d4 References: <CGME20230810092017eucas1p23930e5e5ec443ac7776002f2f09967d4@eucas1p2.samsung.com> X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1773840413812011561 X-GMAIL-MSGID: 1773840413812011561 |
Series |
arm: dma-mapping: don't call folio_next() beyond the requested region
|
|
Commit Message
Marek Szyprowski
Aug. 10, 2023, 9:19 a.m. UTC
Add a check for the non-zero offset case to avoid calling folio_next()
beyond the requested region and relying on its parameters.
Fixes: cc24e9c0895c ("arm: implement the new page table range API")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Suggested-by: Matthew Wilcox <willy@infradead.org>
---
arch/arm/mm/dma-mapping.c | 2 ++
1 file changed, 2 insertions(+)
Comments
On Thu, Aug 10, 2023 at 11:19:55AM +0200, Marek Szyprowski wrote: > Add a check for the non-zero offset case to avoid calling folio_next() > beyond the requested region and relying on its parameters. > > Fixes: cc24e9c0895c ("arm: implement the new page table range API") > Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> > Suggested-by: Matthew Wilcox <willy@infradead.org> > --- > arch/arm/mm/dma-mapping.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index 0474840224d9..6c952d6899f2 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c > @@ -715,6 +715,8 @@ static void __dma_page_dev_to_cpu(struct page *page, unsigned long off, > > if (offset) { > left -= folio_size(folio) - offset; In most cases, "offset" is masked by ~PAGE_MASK, the only exception being when we're walking scatterlists, where it is whatever is in sg->offset. So, what is the range of values that sg->offset could take? If it is guaranteed to be less than PAGE_SIZE (or folio_size() of the first folio) then we're all good. However, consider what happens with the above when offset is larger than the first folio size. To show this, let's rewrite it: left += offset - folio_size(folio); In that case, "left" becomes larger than the original size, which surely is not what we want? This wasn't a problem with the original code, because we guaranteed that "off" was always less than PAGE_SIZE, so left -= PAGE_SIZE - off; would always result in a reduction, but this is no longer the case with folios. The more I'm looking at this, the more I'm convinced that the original conversion is wrong. Let's go back to the original code and see what it is doing: size_t left = size; pfn = page_to_pfn(page) + off / PAGE_SIZE; This positions pfn to be the page frame number to which the page and offset passed into the function reference. off %= PAGE_SIZE; This gives us the offset _within_ that page. if (off) { pfn++; left -= PAGE_SIZE - off; } What this is doing is saying if the first page is a partial page, then we skip marking it clean - only _full_ pages get marked clean. while (left >= PAGE_SIZE) { page = pfn_to_page(pfn++); set_bit(PG_dcache_clean, &page->flags); left -= PAGE_SIZE; } There, we iterate over the size for the number of _whole_ pages only and not a final partial page. Now, if we consider the folio version: + ssize_t left = size; Casts an unsigned to a signed, which will not give expected results if large. + size_t offset = offset_in_folio(folio, paddr); paddr here is the physical address of the page plus the passed in offset. If the offset is larger than a page, then it will be the following pages. What if the offset is larger than the first folio size - bearing in mind that there is no limit on the offset in a scatterlist? If offset is bounded to the size of the folio, then that can truncate the original "offset" that was passed in and we'll end up marking the wrong folios, because: + + if (offset) { + left -= folio_size(folio) - offset; + folio = folio_next(folio); } This only allows us to move to the next folio. Moreover, if offset here _is_ allowed to be bigger than folio_size() then we end up _increasing_ "left" as stated above, so we end up marking _more_ folios as clean than the user of this function requested. + + while (left >= (ssize_t)folio_size(folio)) { + set_bit(PG_dcache_clean, &folio->flags); + left -= folio_size(folio); + folio = folio_next(folio); } So, in all, to me it looks like this conversion is basically wrong, and it needs to be something like: size_t left = size; while (off >= folio_size(folio)) { off -= folio_size(folio); folio = folio_next(folio); } if (off) { /* Partial first folio */ size_t first = folio_size(folio) - off; /* Size doesn't extend the full folio size, so exit */ if (left < first) return; /* Truncate the size and move to the next folio */ left -= first; folio = folio_next(folio); } while (left >= folio_size(folio)) { /* can't become negative */ left -= folio_size(folio); set_bit(PG_dcache_clean, &folio->flags); if (!left) break; folio = folio_next(folio); }
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c index 0474840224d9..6c952d6899f2 100644 --- a/arch/arm/mm/dma-mapping.c +++ b/arch/arm/mm/dma-mapping.c @@ -715,6 +715,8 @@ static void __dma_page_dev_to_cpu(struct page *page, unsigned long off, if (offset) { left -= folio_size(folio) - offset; + if (left <= 0) + return; folio = folio_next(folio); }