Received-SPF: pass (google.com: domain of linux-kernel+bounces-86146-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Michael Kelley <mhklinux@outlook.com>
To: Will Deacon <will@kernel.org>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>
CC: "kernel-team@android.com" <kernel-team@android.com>,
	"iommu@lists.linux.dev" <iommu@lists.linux.dev>, Christoph Hellwig
	<hch@lst.de>, Marek Szyprowski <m.szyprowski@samsung.com>, Robin Murphy
	<robin.murphy@arm.com>, Petr Tesarik <petr.tesarik1@huawei-partners.com>,
	Dexuan Cui <decui@microsoft.com>, Nicolin Chen <nicolinc@nvidia.com>
Subject: RE: [PATCH v5 1/6] swiotlb: Fix double-allocation of slots due to
 broken alignment handling
Thread-Topic: [PATCH v5 1/6] swiotlb: Fix double-allocation of slots due to
 broken alignment handling
Thread-Index: AQHaakuXItTjgViVp0ie0rpUKtCFmLEgz+ug
Date: Thu, 29 Feb 2024 05:44:41 +0000
Message-ID:
 <SN6PR02MB4157412391D227828548F0F5D45F2@SN6PR02MB4157.namprd02.prod.outlook.com>
References: <20240228133930.15400-1-will@kernel.org>
 <20240228133930.15400-2-will@kernel.org>
In-Reply-To: <20240228133930.15400-2-will@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?0PcZZ6inofirbQEAH5AmHDqOvi73DZ9ffq0wftYNB4rdZ3/nAOGEWH+4QXyI?=
 =?us-ascii?Q?BHyci8rAXnVcJ9pE9l/+6+ZE2NOIF2N3cyTCexNMEMyGY90fiPrXT5mqzh6T?=
 =?us-ascii?Q?BRmbpEhL4HpBsuVcsw+/t5KxZGXrYR2UF880bKlN+iZm0jBCbqJfvf4RfJBf?=
 =?us-ascii?Q?LQz94LEw/cr6cHY1nJPYjV0w2DEvUWekRkWfixtLvdN5w3dXpAgM+LczIWq9?=
 =?us-ascii?Q?OjnEgOzvDBH7bcKC8xRCmVk6Yqsu8upMp8BUhbHDCvn+h9CIsHYR6C8cLAcJ?=
 =?us-ascii?Q?Hv9tPFma4pO/w0eMOvOzTtYn+0BvjPw2JP33ozll5KqwXBm+NQ92AnGfcWst?=
 =?us-ascii?Q?mtF2avmtCkVRayR1IVx3CJ7P5/kwyMNAzUZEcoub+fdUwUdqSn8Bu6WwD/iw?=
 =?us-ascii?Q?TgYrnyMq818SuZePtVYVH0Pc6rkkI+b9OOp++c7sxnI2OWybtl9UkC8ydgJJ?=
 =?us-ascii?Q?8U98nIn3+K9f4L3SV8lT9axX/q211QyBxGwyffrChNBstpXlJOcKuzNrPclq?=
 =?us-ascii?Q?Jb3WruPNskb0RCNjCQeUVMphEa6kfLQFWCcSeNvbJ7F2fnKK7tjmk0aU84Ka?=
 =?us-ascii?Q?MC85zXR2zhECGk0dYPtDMVJMZCslXrYSaq0YEvUv2F7DgiB6yA6HdxnGjiuI?=
 =?us-ascii?Q?lR1uhLuptooa3DuxtRyUY3ZJKPuP9zLgXOy7jQeAil4neZg7E+qZ2P5bYQgB?=
 =?us-ascii?Q?0lsSITd39AWtpYsbWBtqPOcCe0DXZSCQrPXE796Y/CEFhjTDjeSxF+l350+g?=
 =?us-ascii?Q?V79VbTGPmkChnx9CtmnWWnlKW0PPiPzYwhyupMjjFn8ga6a9r1hbz7NQlKBA?=
 =?us-ascii?Q?eciweHUKIaDAoBaPWZYOrtznefuvMRyQA38kuXbExrqZWCkOE438GCJ+KmLT?=
 =?us-ascii?Q?eDhkMtRz7cIve4+ilfAst0Rdgt6USrfsImO1LUyvfUN05ocRwSjN0ZUOmGv0?=
 =?us-ascii?Q?/ZMwjq8fNBzu326H7mM16OoCQojldoO8NsAT9LLOl+QgcmVIV0gYk0G9odpJ?=
 =?us-ascii?Q?JHbcfpUgNy3Ex7jJAfq3MdwwDfr2EGN4K+rO5KVWVx8LJdWB6J9gjz/i7E1w?=
 =?us-ascii?Q?b4UrFhwSlbNb8sbXtH8uv9QKlc5+aD3qbE3wYNrdDjbanddLQ5xwgp1HGuvA?=
 =?us-ascii?Q?PqssuN0Jq/JGjygPhTMQ3eLsuSczIQIM/KY9vRRCQoPbwQuyR/x5bcD9yC3N?=
 =?us-ascii?Q?z2mamHkBJoydC8iH+JErTakT/Cx+l2eVdRz58w=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR02MB4157.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 14dd9a19-9fae-47a6-7e30-08dc38e986a2
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Feb 2024 05:44:41.6896
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO6PR02MB7843


From: Will Deacon <will@kernel.org> Sent: Wednesday, February 28, 2024 5:39=
 AM
>=20
> Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"),
> which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment
> checks"), causes a functional regression with vsock in a virtual machine
> using bouncing via a restricted DMA SWIOTLB pool.
>=20
> When virtio allocates the virtqueues for the vsock device using
> dma_alloc_coherent(), the SWIOTLB search can return page-unaligned
> allocations if 'area->index' was left unaligned by a previous allocation
> from the buffer:
>=20
>  # Final address in brackets is the SWIOTLB address returned to the calle=
r
>  | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_=
mask
> 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)
>  | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_=
mask
> 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)
>  | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_=
mask
> 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)
>=20
> This ends badly (typically buffer corruption and/or a hang) because
> swiotlb_alloc() is expecting a page-aligned allocation and so blindly
> returns a pointer to the 'struct page' corresponding to the allocation,
> therefore double-allocating the first half (2KiB slot) of the 4KiB page.
>=20
> Fix the problem by treating the allocation alignment separately to any
> additional alignment requirements from the device, using the maximum
> of the two as the stride to search the buffer slots and taking care
> to ensure a minimum of page-alignment for buffers larger than a page.
>=20
> This also resolves swiotlb allocation failures occuring due to the
> inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and
> resulting in alignment requirements exceeding swiotlb_max_mapping_size().
>=20
> Fixes: bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix")
> Fixes: 0eee5ae10256 ("swiotlb: fix slot alignment checks")
> Cc: Christoph Hellwig <hch@lst.de>
> Cc: Marek Szyprowski <m.szyprowski@samsung.com>
> Cc: Robin Murphy <robin.murphy@arm.com>
> Cc: Dexuan Cui <decui@microsoft.com>
> Reviewed-by: Petr Tesarik <petr.tesarik1@huawei-partners.com>
> Tested-by: Nicolin Chen <nicolinc@nvidia.com>
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
>  kernel/dma/swiotlb.c | 28 +++++++++++++++-------------
>  1 file changed, 15 insertions(+), 13 deletions(-)
>=20

Reviewed-by: Michael Kelley <mhklinux@outlook.com>