All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v4 9/9] dmapool: debug: prevent endless loop in case of corruption
@ 2018-11-12 15:46 ` Tony Battersby
  0 siblings, 0 replies; 20+ messages in thread
From: Tony Battersby @ 2018-11-12 15:46 UTC (permalink / raw)
  To: Matthew Wilcox, Christoph Hellwig, Marek Szyprowski,
	iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
	linux-mm-Bw31MaZKKs3YtjvyW6yDsg
  Cc: linux-scsi-u79uwXL29TY76Z2rM5mHXA

Prevent a possible endless loop with DMAPOOL_DEBUG enabled if a buggy
driver corrupts DMA pool memory.

Signed-off-by: Tony Battersby <tonyb-vFAe+i1/wJI5UWNf+nJyDw@public.gmane.org>
---
--- linux/mm/dmapool.c.orig	2018-08-06 17:52:53.000000000 -0400
+++ linux/mm/dmapool.c	2018-08-06 17:53:31.000000000 -0400
@@ -454,17 +454,39 @@ void dma_pool_free(struct dma_pool *pool
 	{
 		void *page_vaddr = vaddr - offset;
 		unsigned int chain = page->dma_free_off;
+		unsigned int free_blks = 0;
+
 		while (chain < pool->allocation) {
-			if (chain != offset) {
-				chain = *(int *)(page_vaddr + chain);
-				continue;
+			if (unlikely(chain == offset)) {
+				spin_unlock_irqrestore(&pool->lock, flags);
+				dev_err(pool->dev,
+					"dma_pool_free %s, dma %pad already free\n",
+					pool->name, &dma);
+				return;
+			}
+
+			/*
+			 * A buggy driver could corrupt the freelist by
+			 * use-after-free, buffer overflow, etc.  Besides
+			 * checking for corruption, this also prevents an
+			 * endless loop in case corruption causes a circular
+			 * loop in the freelist.
+			 */
+			if (unlikely(++free_blks + page->dma_in_use >
+				     pool->blks_per_alloc)) {
+ freelist_corrupt:
+				spin_unlock_irqrestore(&pool->lock, flags);
+				dev_err(pool->dev,
+					"dma_pool_free %s, freelist corrupted\n",
+					pool->name);
+				return;
 			}
-			spin_unlock_irqrestore(&pool->lock, flags);
-			dev_err(pool->dev,
-				"dma_pool_free %s, dma %pad already free\n",
-				pool->name, &dma);
-			return;
+
+			chain = *(int *)(page_vaddr + chain);
 		}
+		if (unlikely(free_blks + page->dma_in_use !=
+			     pool->blks_per_alloc))
+			goto freelist_corrupt;
 	}
 	memset(vaddr, POOL_POISON_FREED, pool->size);
 #endif

^ permalink raw reply	[flat|nested] 20+ messages in thread

end of thread, other threads:[~2018-12-04 22:05 UTC | newest]

Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-12 15:46 [PATCH v4 9/9] dmapool: debug: prevent endless loop in case of corruption Tony Battersby
2018-11-12 15:46 ` Tony Battersby
     [not found] ` <9e65ec2e-5e22-4f65-7b92-ca2af0c555f3-vFAe+i1/wJI5UWNf+nJyDw@public.gmane.org>
2018-11-13  6:36   ` Matthew Wilcox
2018-11-13  6:36     ` Matthew Wilcox
     [not found]     ` <20181113063601.GT21824-PfSpb0PWhxZc2C7mugBRk2EX/6BAtgUQ@public.gmane.org>
2018-12-04 16:22       ` Tony Battersby
2018-12-04 16:22         ` Tony Battersby
     [not found]         ` <4dcb22b0-a348-841d-8175-e368f67f33c3-vFAe+i1/wJI5UWNf+nJyDw@public.gmane.org>
2018-12-04 20:14           ` Andrew Morton
2018-12-04 20:14             ` Andrew Morton
     [not found]             ` <20181204121443.1430883634a6ecf5f4a6a4a2-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2018-12-04 20:18               ` Matthew Wilcox
2018-12-04 20:18                 ` Matthew Wilcox
     [not found]                 ` <20181204201801.GS10377-PfSpb0PWhxZc2C7mugBRk2EX/6BAtgUQ@public.gmane.org>
2018-12-04 20:28                   ` Andrew Morton
2018-12-04 20:28                     ` Andrew Morton
     [not found]                     ` <20181204122854.339503ccbbdc638940c9e1d0-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2018-12-04 20:35                       ` Matthew Wilcox
2018-12-04 20:35                         ` Matthew Wilcox
2018-12-04 20:30                   ` Andy Shevchenko
2018-12-04 20:30                     ` Andy Shevchenko
     [not found]                     ` <CAHp75VeCHnUcE8mfUkx_uXz9_ZoA+hAvVtFiFP+nLj4rJevBdw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-12-04 21:26                       ` Tony Battersby
2018-12-04 21:26                         ` Tony Battersby
     [not found]                         ` <495c7e22-9332-1654-9ee0-63c33fae980e-vFAe+i1/wJI5UWNf+nJyDw@public.gmane.org>
2018-12-04 22:05                           ` Andy Shevchenko
2018-12-04 22:05                             ` Andy Shevchenko

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.