All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Christoph Hellwig <hch@lst.de>
Cc: Hillf Danton <hdanton@sina.com>,
	syzbot <syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	jeremy.linton@arm.com, linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	x86@kernel.org
Subject: Validating dma_mmap_coherent() parameters before calling (was Re: WARNING in memtype_reserve)
Date: Thu, 14 May 2020 08:27:50 +0200	[thread overview]
Message-ID: <20200514062750.GA1488715@kroah.com> (raw)
In-Reply-To: <20200514061417.GA8367@lst.de>

On Thu, May 14, 2020 at 08:14:17AM +0200, Christoph Hellwig wrote:
> Guys, can you please start formal thread on this?  I have no
> idea where this came from and what the rationale is.  Btw, if the
> pfn is crap in dma_direct_mmap then the dma_addr_t passed in is
> crap, as it is derived from that.  What is the caller, and how is
> this triggered?


Ok, to summarize, commit 2bef9aed6f0e ("usb: usbfs: correct kernel->user
page attribute mismatch") changed a call from remap_pfn_range() to
dma_mmap_coherent() for usb data buffers being sent from userspace.

Details on why this was changed is in the commit changelog, but this has
triggered a WARN_ON() in memtype_reserve when I think some odd data
buffers were sent to it by syzbot fuzzing.

The warning caught the wrong data, but triggered syzbot.

So, the question is, should all callers of dma_mmap_coherent() validate
the parms better before it is called, or should the call chain here
properly sanitize things on their own.

Note, usbfs is not the only direct-from-userspace caller of
dma_mmap_coherent(), it's also used in other userspace apis (frame
buffer drivers, fastrpc, some SoC drivers) but it looks like nothing has
fuzzed those apis before to trigger this.

Does that help explain things better?

thanks,

greg k-h

  parent reply	other threads:[~2020-05-14  6:27 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-09  7:20 WARNING in memtype_reserve syzbot
2020-05-09  7:45 ` Greg KH
2020-05-09 10:00   ` Thomas Gleixner
2020-05-09 13:41     ` Alan Stern
2020-05-13 16:21       ` Thomas Gleixner
2020-05-13 12:44     ` Greg KH
2020-05-13 16:22       ` Thomas Gleixner
2020-05-13 16:55         ` Greg KH
     [not found]         ` <20200514035458.14760-1-hdanton@sina.com>
2020-05-14  6:14           ` Christoph Hellwig
2020-05-14  6:19             ` Dmitry Vyukov
2020-05-14  6:27             ` Greg KH [this message]
2020-05-14  6:31               ` Validating dma_mmap_coherent() parameters before calling (was Re: WARNING in memtype_reserve) Christoph Hellwig
2020-05-14  7:46                 ` Greg KH
2020-05-14 11:17                   ` Jeremy Linton
2020-05-14 11:22                     ` Greg KH
2020-05-14 11:10                 ` Jeremy Linton
2020-05-14 11:14                   ` Christoph Hellwig
2020-05-14 11:16                     ` Jeremy Linton
2020-05-14  9:08           ` WARNING in memtype_reserve syzbot
2020-05-09 17:42 ` Jeremy Linton
     [not found] ` <20200509154728.1548-1-hdanton@sina.com>
2020-05-13 12:41   ` Greg KH
2020-05-14  9:20 ` Greg KH
2020-05-14 10:44   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200514062750.GA1488715@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=hch@lst.de \
    --cc=hdanton@sina.com \
    --cc=jeremy.linton@arm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.