Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752137AbdITWrp (ORCPT ); Wed, 20 Sep 2017 18:47:45 -0400 Received: from mail-io0-f181.google.com ([209.85.223.181]:50933 "EHLO mail-io0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752090AbdITWrm (ORCPT ); Wed, 20 Sep 2017 18:47:42 -0400 X-Google-Smtp-Source: AOwi7QBcVLby0HyJFWUjRMh9pg9zhgT4T1fWP2svGsDAsXiDs76ApDO6KuO/AROaqQhJZc9o7h0CXw== Date: Wed, 20 Sep 2017 16:47:39 -0600 From: Tycho Andersen To: Dave Hansen Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com, Marco Benatto , Juerg Haefliger , Juerg Haefliger Subject: Re: [PATCH v5 03/10] swiotlb: Map the buffer if it was unmapped by XPFO Message-ID: <20170920224739.3kgzmntabmkedohw@smitten> References: <20170809200755.11234-1-tycho@docker.com> <20170809200755.11234-4-tycho@docker.com> <5877eed8-0e8e-0dec-fdc7-de01bdbdafa8@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5877eed8-0e8e-0dec-fdc7-de01bdbdafa8@intel.com> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1301 Lines: 36 On Wed, Sep 20, 2017 at 09:19:56AM -0700, Dave Hansen wrote: > On 08/09/2017 01:07 PM, Tycho Andersen wrote: > > --- a/lib/swiotlb.c > > +++ b/lib/swiotlb.c > > @@ -420,8 +420,9 @@ static void swiotlb_bounce(phys_addr_t orig_addr, phys_addr_t tlb_addr, > > { > > unsigned long pfn = PFN_DOWN(orig_addr); > > unsigned char *vaddr = phys_to_virt(tlb_addr); > > + struct page *page = pfn_to_page(pfn); > > > > - if (PageHighMem(pfn_to_page(pfn))) { > > + if (PageHighMem(page) || xpfo_page_is_unmapped(page)) { > > /* The buffer does not have a mapping. Map it in and copy */ > > unsigned int offset = orig_addr & ~PAGE_MASK; > > char *buffer; > > This is a little scary. I wonder how many more of these are in the > kernel, like: I don't know, but I assume several :) > > static inline void *skcipher_map(struct scatter_walk *walk) > > { > > struct page *page = scatterwalk_page(walk); > > > > return (PageHighMem(page) ? kmap_atomic(page) : page_address(page)) + > > offset_in_page(walk->offset); > > } > > Is there any better way to catch these? Like, can we add some debugging > to check for XPFO pages in __va()? Yes, and perhaps also a debugging check in PageHighMem? Would __va have caught either of the two cases you've pointed out? Tycho