All of lore.kernel.org
 help / color / mirror / Atom feed
From: jacopo mondi <jacopo@jmondi.org>
To: Christoph Hellwig <hch@infradead.org>
Cc: Jacopo Mondi <jacopo+renesas@jmondi.org>,
	ysato@users.sourceforge.jp, dalias@libc.org,
	thomas.petazzoni@free-electrons.com, robin.murphy@arm.com,
	geert@linux-m68k.org, linux-renesas-soc@vger.kernel.org,
	linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] sh: mm: Fix unprotected access to struct device
Date: Wed, 18 Apr 2018 13:13:14 +0000	[thread overview]
Message-ID: <20180418131314.GC3999@w540> (raw)
In-Reply-To: <20180418104703.GA12462@infradead.org>

[-- Attachment #1: Type: text/plain, Size: 1476 bytes --]

Hi Christoph,

On Wed, Apr 18, 2018 at 03:47:03AM -0700, Christoph Hellwig wrote:
> On Tue, Apr 17, 2018 at 03:35:23PM +0200, Jacopo Mondi wrote:
> > With commit ce88313069c36eef80f21fd7 ("arch/sh: make the DMA mapping
> > operations observe dev->dma_pfn_offset") the generic DMA allocation
> > function on which the SH 'dma_alloc_coherent()' function relies on,
> > access the 'dma_pfn_offset' field of struct device.
> >
> > Unfortunately the 'dma_generic_alloc_coherent()' function is called from
> > several places with a NULL struct device argument, halting the CPU
> > during the boot process.
> >
> > This patch fixes the issue protecting access to dev->dma_pfn_offset,
> > with a trivial check for validity. It also passes a valid 'struct device'
> > in the 'platform_resource_setup_memory' function which is the main user
> > of 'dma_alloc_coherent()', and inserting a WARN_ON() check to make future
> > (and existing) bogus users of this function they're should provide a valid
> > 'struct device' whenever possible.
>
> Please fix those callers to not pass a NULL pointer instead.

As long as it goes for arch/sh, the only user of dma_alloc_coherent()
is platform_resource_setup_memory(), and it has been fixed by this
patch.

Unfortunately, as Thomas pointed out, there are drivers which calls
into this with the wrong 'struct device' as the sh_eth one he had fixed.

I would then say that as long as it goes for the NULL case, we should be
fine now.

Thanks
   j

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: jacopo mondi <jacopo@jmondi.org>
To: Christoph Hellwig <hch@infradead.org>
Cc: Jacopo Mondi <jacopo+renesas@jmondi.org>,
	ysato@users.sourceforge.jp, dalias@libc.org,
	thomas.petazzoni@free-electrons.com, robin.murphy@arm.com,
	geert@linux-m68k.org, linux-renesas-soc@vger.kernel.org,
	linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] sh: mm: Fix unprotected access to struct device
Date: Wed, 18 Apr 2018 15:13:14 +0200	[thread overview]
Message-ID: <20180418131314.GC3999@w540> (raw)
In-Reply-To: <20180418104703.GA12462@infradead.org>

[-- Attachment #1: Type: text/plain, Size: 1476 bytes --]

Hi Christoph,

On Wed, Apr 18, 2018 at 03:47:03AM -0700, Christoph Hellwig wrote:
> On Tue, Apr 17, 2018 at 03:35:23PM +0200, Jacopo Mondi wrote:
> > With commit ce88313069c36eef80f21fd7 ("arch/sh: make the DMA mapping
> > operations observe dev->dma_pfn_offset") the generic DMA allocation
> > function on which the SH 'dma_alloc_coherent()' function relies on,
> > access the 'dma_pfn_offset' field of struct device.
> >
> > Unfortunately the 'dma_generic_alloc_coherent()' function is called from
> > several places with a NULL struct device argument, halting the CPU
> > during the boot process.
> >
> > This patch fixes the issue protecting access to dev->dma_pfn_offset,
> > with a trivial check for validity. It also passes a valid 'struct device'
> > in the 'platform_resource_setup_memory' function which is the main user
> > of 'dma_alloc_coherent()', and inserting a WARN_ON() check to make future
> > (and existing) bogus users of this function they're should provide a valid
> > 'struct device' whenever possible.
>
> Please fix those callers to not pass a NULL pointer instead.

As long as it goes for arch/sh, the only user of dma_alloc_coherent()
is platform_resource_setup_memory(), and it has been fixed by this
patch.

Unfortunately, as Thomas pointed out, there are drivers which calls
into this with the wrong 'struct device' as the sh_eth one he had fixed.

I would then say that as long as it goes for the NULL case, we should be
fine now.

Thanks
   j

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

  reply	other threads:[~2018-04-18 13:13 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-17 13:35 [PATCH] sh: mm: Fix unprotected access to struct device Jacopo Mondi
2018-04-17 13:35 ` Jacopo Mondi
2018-04-17 13:54 ` Thomas Petazzoni
2018-04-17 13:54   ` Thomas Petazzoni
2018-04-17 13:59   ` jacopo mondi
2018-04-17 13:59     ` jacopo mondi
2018-04-20  8:30   ` Christoph Hellwig
2018-04-20  8:30     ` Christoph Hellwig
2018-04-17 14:04 ` Geert Uytterhoeven
2018-04-17 14:04   ` Geert Uytterhoeven
2018-04-17 14:20   ` jacopo mondi
2018-04-17 14:20     ` jacopo mondi
2018-04-18  9:13 ` Sergei Shtylyov
2018-04-18  9:13   ` Sergei Shtylyov
2018-04-18 10:47 ` Christoph Hellwig
2018-04-18 10:47   ` Christoph Hellwig
2018-04-18 13:13   ` jacopo mondi [this message]
2018-04-18 13:13     ` jacopo mondi
2018-04-20  8:31     ` Christoph Hellwig
2018-04-20  8:31       ` Christoph Hellwig
2018-04-20  9:59       ` Geert Uytterhoeven
2018-04-20  9:59         ` Geert Uytterhoeven
2018-04-20 14:56         ` Rich Felker
2018-04-20 14:56           ` Rich Felker
2018-05-02  7:41         ` jacopo mondi
2018-05-02  7:41           ` jacopo mondi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180418131314.GC3999@w540 \
    --to=jacopo@jmondi.org \
    --cc=dalias@libc.org \
    --cc=geert@linux-m68k.org \
    --cc=hch@infradead.org \
    --cc=jacopo+renesas@jmondi.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-renesas-soc@vger.kernel.org \
    --cc=linux-sh@vger.kernel.org \
    --cc=robin.murphy@arm.com \
    --cc=thomas.petazzoni@free-electrons.com \
    --cc=ysato@users.sourceforge.jp \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.