LinuxLists.cc - [PATCH v2] dma-mapping: Use dma_get_mask in dma_addressing

2019-07-22 17:45:04

Subject: [PATCH v2] dma-mapping: Use dma_get_mask in dma_addressing_limited

We currently have cases where the dma_addressing_limited() gets
called with dma_mask unset. This causes a NULL pointer dereference.

Use dma_get_mask() accessor to prevent the crash.

Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper")
Signed-off-by: Eric Auger <[email protected]>

---

v1 -> v2:
- was [PATCH 1/2] dma-mapping: Protect dma_addressing_limited
against NULL dma_mask
- Use dma_get_mask
---
include/linux/dma-mapping.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index e11b115dd0e4..f7d1eea32c78 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -689,8 +689,8 @@ static inline int dma_coerce_mask_and_coherent(struct device *dev, u64 mask)
*/
static inline bool dma_addressing_limited(struct device *dev)
{
- return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
- dma_get_required_mask(dev);
+ return min_not_zero(dma_get_mask(dev), dev->bus_dma_mask) <
+ dma_get_required_mask(dev);
}

#ifdef CONFIG_ARCH_HAS_SETUP_DMA_OPS
--
2.20.1

2019-07-22 17:47:28

by Eric Auger

[permalink] [raw]

Subject: Re: [PATCH v2] dma-mapping: Use dma_get_mask in dma_addressing_limited

Hi Christoph,

On 7/22/19 6:51 PM, Eric Auger wrote:
> We currently have cases where the dma_addressing_limited() gets
> called with dma_mask unset. This causes a NULL pointer dereference.
>
> Use dma_get_mask() accessor to prevent the crash.
>
> Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper")
> Signed-off-by: Eric Auger <[email protected]>

As a follow-up of my last email, here is a patch featuring
dma_get_mask(). But you don't have the WARN_ON_ONCE anymore, pointing
out suspect users.

Feel free to pick up your preferred approach

Thanks

Eric
>
> ---
>
> v1 -> v2:
> - was [PATCH 1/2] dma-mapping: Protect dma_addressing_limited
> against NULL dma_mask
> - Use dma_get_mask
> ---
> include/linux/dma-mapping.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
> index e11b115dd0e4..f7d1eea32c78 100644
> --- a/include/linux/dma-mapping.h
> +++ b/include/linux/dma-mapping.h
> @@ -689,8 +689,8 @@ static inline int dma_coerce_mask_and_coherent(struct device *dev, u64 mask)
> */
> static inline bool dma_addressing_limited(struct device *dev)
> {
> - return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
> - dma_get_required_mask(dev);
> + return min_not_zero(dma_get_mask(dev), dev->bus_dma_mask) <
> + dma_get_required_mask(dev);
> }
>
> #ifdef CONFIG_ARCH_HAS_SETUP_DMA_OPS
>

2019-07-23 00:42:44

by Michael S. Tsirkin

[permalink] [raw]

Subject: Re: [PATCH v2] dma-mapping: Use dma_get_mask in dma_addressing_limited

On Mon, Jul 22, 2019 at 06:51:49PM +0200, Eric Auger wrote:
> We currently have cases where the dma_addressing_limited() gets
> called with dma_mask unset. This causes a NULL pointer dereference.
>
> Use dma_get_mask() accessor to prevent the crash.
>
> Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper")
> Signed-off-by: Eric Auger <[email protected]>

Acked-by: Michael S. Tsirkin <[email protected]>

If possible I really prefer this approach: avoids changing all callers
and uses documented interfaces.

> ---
>
> v1 -> v2:
> - was [PATCH 1/2] dma-mapping: Protect dma_addressing_limited
> against NULL dma_mask
> - Use dma_get_mask
> ---
> include/linux/dma-mapping.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
> index e11b115dd0e4..f7d1eea32c78 100644
> --- a/include/linux/dma-mapping.h
> +++ b/include/linux/dma-mapping.h
> @@ -689,8 +689,8 @@ static inline int dma_coerce_mask_and_coherent(struct device *dev, u64 mask)
> */
> static inline bool dma_addressing_limited(struct device *dev)
> {
> - return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
> - dma_get_required_mask(dev);
> + return min_not_zero(dma_get_mask(dev), dev->bus_dma_mask) <
> + dma_get_required_mask(dev);
> }
>
> #ifdef CONFIG_ARCH_HAS_SETUP_DMA_OPS
> --
> 2.20.1

2019-07-23 04:43:51

by Michael S. Tsirkin

[permalink] [raw]

Subject: Re: [PATCH v2] dma-mapping: Use dma_get_mask in dma_addressing_limited

On Mon, Jul 22, 2019 at 06:56:49PM +0200, Auger Eric wrote:
> Hi Christoph,
>
> On 7/22/19 6:51 PM, Eric Auger wrote:
> > We currently have cases where the dma_addressing_limited() gets
> > called with dma_mask unset. This causes a NULL pointer dereference.
> >
> > Use dma_get_mask() accessor to prevent the crash.
> >
> > Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper")
> > Signed-off-by: Eric Auger <[email protected]>
>
> As a follow-up of my last email, here is a patch featuring
> dma_get_mask(). But you don't have the WARN_ON_ONCE anymore, pointing
> out suspect users.

OTOH these users then simply become okay so no need for WARN_ON_ONCE
then :)

> Feel free to pick up your preferred approach
>
> Thanks
>
> Eric
> >
> > ---
> >
> > v1 -> v2:
> > - was [PATCH 1/2] dma-mapping: Protect dma_addressing_limited
> > against NULL dma_mask
> > - Use dma_get_mask
> > ---
> > include/linux/dma-mapping.h | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
> > index e11b115dd0e4..f7d1eea32c78 100644
> > --- a/include/linux/dma-mapping.h
> > +++ b/include/linux/dma-mapping.h
> > @@ -689,8 +689,8 @@ static inline int dma_coerce_mask_and_coherent(struct device *dev, u64 mask)
> > */
> > static inline bool dma_addressing_limited(struct device *dev)
> > {
> > - return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
> > - dma_get_required_mask(dev);
> > + return min_not_zero(dma_get_mask(dev), dev->bus_dma_mask) <
> > + dma_get_required_mask(dev);
> > }
> >
> > #ifdef CONFIG_ARCH_HAS_SETUP_DMA_OPS
> >

2019-07-24 00:46:06

by Christoph Hellwig

[permalink] [raw]