2015-05-15 07:10:10

by Alexandre Courbot

[permalink] [raw]
Subject: [PATCH] drm/ttm: dma: Don't crash on memory in the vmalloc range

dma_alloc_coherent() can return memory in the vmalloc range.
virt_to_page() cannot handle such addresses and crashes. This
patch detects such cases and obtains the struct page * using
vmalloc_to_page() instead.

Signed-off-by: Alexandre Courbot <[email protected]>
---
This patch is a follow-up of the following discussion:

https://www.marc.info/?l=dri-devel&m=141579595431254&w=3

It works for me on both 32-bit and 64-bit Tegra, so I am not convinced
that Thierry's initial change from virt_to_page() to phys_to_page() is
still required - Thierry, can you confirm whether your patch is still
relevant after this one?

drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 01e1d27eb078..3077f1554099 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -342,9 +342,12 @@ static struct dma_page *__ttm_dma_alloc_page(struct dma_pool *pool)
d_page->vaddr = dma_alloc_coherent(pool->dev, pool->size,
&d_page->dma,
pool->gfp_flags);
- if (d_page->vaddr)
- d_page->p = virt_to_page(d_page->vaddr);
- else {
+ if (d_page->vaddr) {
+ if (is_vmalloc_addr(d_page->vaddr))
+ d_page->p = vmalloc_to_page(d_page->vaddr);
+ else
+ d_page->p = virt_to_page(d_page->vaddr);
+ } else {
kfree(d_page);
d_page = NULL;
}
--
2.4.0


2015-05-15 10:49:05

by Thierry Reding

[permalink] [raw]
Subject: Re: [PATCH] drm/ttm: dma: Don't crash on memory in the vmalloc range

On Fri, May 15, 2015 at 04:09:54PM +0900, Alexandre Courbot wrote:
> dma_alloc_coherent() can return memory in the vmalloc range.
> virt_to_page() cannot handle such addresses and crashes. This
> patch detects such cases and obtains the struct page * using
> vmalloc_to_page() instead.
>
> Signed-off-by: Alexandre Courbot <[email protected]>
> ---
> This patch is a follow-up of the following discussion:
>
> https://www.marc.info/?l=dri-devel&m=141579595431254&w=3
>
> It works for me on both 32-bit and 64-bit Tegra, so I am not convinced
> that Thierry's initial change from virt_to_page() to phys_to_page() is
> still required - Thierry, can you confirm whether your patch is still
> relevant after this one?

If this works for you on both 32-bit and 64-bit Tegra I don't think the
earlier patch is still relevant and this looks indeed like a much more
appropriate solution.

Thierry


Attachments:
(No filename) (894.00 B)
(No filename) (819.00 B)
Download all attachments

2015-05-15 12:03:31

by yalin wang

[permalink] [raw]
Subject: Re: [PATCH] drm/ttm: dma: Don't crash on memory in the vmalloc range

2015-05-15 15:09 GMT+08:00 Alexandre Courbot <[email protected]>:
> dma_alloc_coherent() can return memory in the vmalloc range.
> virt_to_page() cannot handle such addresses and crashes. This
> patch detects such cases and obtains the struct page * using
> vmalloc_to_page() instead.
>
> Signed-off-by: Alexandre Courbot <[email protected]>
> ---
> This patch is a follow-up of the following discussion:
>
> https://www.marc.info/?l=dri-devel&m=141579595431254&w=3
>
> It works for me on both 32-bit and 64-bit Tegra, so I am not convinced
> that Thierry's initial change from virt_to_page() to phys_to_page() is
> still required - Thierry, can you confirm whether your patch is still
> relevant after this one?
>
> drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> index 01e1d27eb078..3077f1554099 100644
> --- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> +++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> @@ -342,9 +342,12 @@ static struct dma_page *__ttm_dma_alloc_page(struct dma_pool *pool)
> d_page->vaddr = dma_alloc_coherent(pool->dev, pool->size,
> &d_page->dma,
> pool->gfp_flags);
> - if (d_page->vaddr)
> - d_page->p = virt_to_page(d_page->vaddr);
> - else {
> + if (d_page->vaddr) {
> + if (is_vmalloc_addr(d_page->vaddr))
> + d_page->p = vmalloc_to_page(d_page->vaddr);
> + else
> + d_page->p = virt_to_page(d_page->vaddr);
> + } else {
> kfree(d_page);
> d_page = NULL;
> }
> --
> 2.4.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/

for safe , i think we can add this patch:


diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index f800d45..3463f4f 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -77,7 +77,8 @@
* private definitions which should NOT be used outside memory.h
* files. Use virt_to_phys/phys_to_virt/__pa/__va instead.
*/
-#define __virt_to_phys(x) (((phys_addr_t)(x) - PAGE_OFFSET + PHYS_OFFSET))
+#define __virt_to_phys(x) ({BUG_ON(x < PAGE_OFFSET);\
+ (phys_addr_t)(x) - PAGE_OFFSET + PHYS_OFFSET;})
#define __phys_to_virt(x) ((unsigned long)((x) - PHYS_OFFSET + PAGE_OFFSET))

/*


BRs
Yalin

2015-05-15 19:56:13

by Konrad Rzeszutek Wilk

[permalink] [raw]
Subject: Re: [PATCH] drm/ttm: dma: Don't crash on memory in the vmalloc range

On Fri, May 15, 2015 at 04:09:54PM +0900, Alexandre Courbot wrote:
> dma_alloc_coherent() can return memory in the vmalloc range.
> virt_to_page() cannot handle such addresses and crashes. This
> patch detects such cases and obtains the struct page * using
> vmalloc_to_page() instead.
>
> Signed-off-by: Alexandre Courbot <[email protected]>
> ---
> This patch is a follow-up of the following discussion:
>
> https://www.marc.info/?l=dri-devel&m=141579595431254&w=3
>
> It works for me on both 32-bit and 64-bit Tegra, so I am not convinced
> that Thierry's initial change from virt_to_page() to phys_to_page() is
> still required - Thierry, can you confirm whether your patch is still
> relevant after this one?
>
> drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> index 01e1d27eb078..3077f1554099 100644
> --- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> +++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> @@ -342,9 +342,12 @@ static struct dma_page *__ttm_dma_alloc_page(struct dma_pool *pool)
> d_page->vaddr = dma_alloc_coherent(pool->dev, pool->size,
> &d_page->dma,
> pool->gfp_flags);
> - if (d_page->vaddr)
> - d_page->p = virt_to_page(d_page->vaddr);
> - else {
> + if (d_page->vaddr) {
> + if (is_vmalloc_addr(d_page->vaddr))
> + d_page->p = vmalloc_to_page(d_page->vaddr);
> + else
> + d_page->p = virt_to_page(d_page->vaddr);
> + } else {


Looks OK to me.

> kfree(d_page);
> d_page = NULL;
> }
> --
> 2.4.0
>

2015-05-19 11:34:09

by Alexandre Courbot

[permalink] [raw]
Subject: Re: [PATCH] drm/ttm: dma: Don't crash on memory in the vmalloc range

On 05/16/2015 04:55 AM, Konrad Rzeszutek Wilk wrote:
> On Fri, May 15, 2015 at 04:09:54PM +0900, Alexandre Courbot wrote:
>> dma_alloc_coherent() can return memory in the vmalloc range.
>> virt_to_page() cannot handle such addresses and crashes. This
>> patch detects such cases and obtains the struct page * using
>> vmalloc_to_page() instead.
>>
>> Signed-off-by: Alexandre Courbot <[email protected]>
>> ---
>> This patch is a follow-up of the following discussion:
>>
>> https://www.marc.info/?l=dri-devel&m=141579595431254&w=3
>>
>> It works for me on both 32-bit and 64-bit Tegra, so I am not convinced
>> that Thierry's initial change from virt_to_page() to phys_to_page() is
>> still required - Thierry, can you confirm whether your patch is still
>> relevant after this one?
>>
>> drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 9 ++++++---
>> 1 file changed, 6 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
>> index 01e1d27eb078..3077f1554099 100644
>> --- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
>> +++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
>> @@ -342,9 +342,12 @@ static struct dma_page *__ttm_dma_alloc_page(struct dma_pool *pool)
>> d_page->vaddr = dma_alloc_coherent(pool->dev, pool->size,
>> &d_page->dma,
>> pool->gfp_flags);
>> - if (d_page->vaddr)
>> - d_page->p = virt_to_page(d_page->vaddr);
>> - else {
>> + if (d_page->vaddr) {
>> + if (is_vmalloc_addr(d_page->vaddr))
>> + d_page->p = vmalloc_to_page(d_page->vaddr);
>> + else
>> + d_page->p = virt_to_page(d_page->vaddr);
>> + } else {
>
>
> Looks OK to me.

Thanks guys. Could we translate these approvals into
Acked-bys/Reviewed-bys so Dave (?) can merge this patch?

2015-06-01 17:28:41

by Konrad Rzeszutek Wilk

[permalink] [raw]
Subject: Re: [PATCH] drm/ttm: dma: Don't crash on memory in the vmalloc range

On Tue, May 19, 2015 at 08:33:59PM +0900, Alexandre Courbot wrote:
> On 05/16/2015 04:55 AM, Konrad Rzeszutek Wilk wrote:
> >On Fri, May 15, 2015 at 04:09:54PM +0900, Alexandre Courbot wrote:
> >>dma_alloc_coherent() can return memory in the vmalloc range.
> >>virt_to_page() cannot handle such addresses and crashes. This
> >>patch detects such cases and obtains the struct page * using
> >>vmalloc_to_page() instead.
> >>
> >>Signed-off-by: Alexandre Courbot <[email protected]>
> >>---
> >>This patch is a follow-up of the following discussion:
> >>
> >>https://www.marc.info/?l=dri-devel&m=141579595431254&w=3
> >>
> >>It works for me on both 32-bit and 64-bit Tegra, so I am not convinced
> >>that Thierry's initial change from virt_to_page() to phys_to_page() is
> >>still required - Thierry, can you confirm whether your patch is still
> >>relevant after this one?
> >>
> >> drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 9 ++++++---
> >> 1 file changed, 6 insertions(+), 3 deletions(-)
> >>
> >>diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> >>index 01e1d27eb078..3077f1554099 100644
> >>--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> >>+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
> >>@@ -342,9 +342,12 @@ static struct dma_page *__ttm_dma_alloc_page(struct dma_pool *pool)
> >> d_page->vaddr = dma_alloc_coherent(pool->dev, pool->size,
> >> &d_page->dma,
> >> pool->gfp_flags);
> >>- if (d_page->vaddr)
> >>- d_page->p = virt_to_page(d_page->vaddr);
> >>- else {
> >>+ if (d_page->vaddr) {
> >>+ if (is_vmalloc_addr(d_page->vaddr))
> >>+ d_page->p = vmalloc_to_page(d_page->vaddr);
> >>+ else
> >>+ d_page->p = virt_to_page(d_page->vaddr);
> >>+ } else {
> >
> >
> >Looks OK to me.
>
> Thanks guys. Could we translate these approvals into Acked-bys/Reviewed-bys
> so Dave (?) can merge this patch?

Acked-by: Konrad Rzeszutek Wilk <[email protected]>