From: Michael Kelley <mhklinux@outlook.com>
To: Will Deacon <will@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: "kernel-team@android.com" <kernel-team@android.com>,
"iommu@lists.linux.dev" <iommu@lists.linux.dev>,
Christoph Hellwig <hch@lst.de>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Robin Murphy <robin.murphy@arm.com>,
Petr Tesarik <petr.tesarik1@huawei-partners.com>,
Dexuan Cui <decui@microsoft.com>,
Nicolin Chen <nicolinc@nvidia.com>
Subject: RE: [PATCH v5 1/6] swiotlb: Fix double-allocation of slots due to broken alignment handling
Date: Thu, 29 Feb 2024 05:44:41 +0000 [thread overview]
Message-ID: <SN6PR02MB4157412391D227828548F0F5D45F2@SN6PR02MB4157.namprd02.prod.outlook.com> (raw)
In-Reply-To: <20240228133930.15400-2-will@kernel.org>
From: Will Deacon <will@kernel.org> Sent: Wednesday, February 28, 2024 5:39 AM
>
> Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"),
> which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment
> checks"), causes a functional regression with vsock in a virtual machine
> using bouncing via a restricted DMA SWIOTLB pool.
>
> When virtio allocates the virtqueues for the vsock device using
> dma_alloc_coherent(), the SWIOTLB search can return page-unaligned
> allocations if 'area->index' was left unaligned by a previous allocation
> from the buffer:
>
> # Final address in brackets is the SWIOTLB address returned to the caller
> | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask
> 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)
> | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask
> 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)
> | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask
> 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)
>
> This ends badly (typically buffer corruption and/or a hang) because
> swiotlb_alloc() is expecting a page-aligned allocation and so blindly
> returns a pointer to the 'struct page' corresponding to the allocation,
> therefore double-allocating the first half (2KiB slot) of the 4KiB page.
>
> Fix the problem by treating the allocation alignment separately to any
> additional alignment requirements from the device, using the maximum
> of the two as the stride to search the buffer slots and taking care
> to ensure a minimum of page-alignment for buffers larger than a page.
>
> This also resolves swiotlb allocation failures occuring due to the
> inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and
> resulting in alignment requirements exceeding swiotlb_max_mapping_size().
>
> Fixes: bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix")
> Fixes: 0eee5ae10256 ("swiotlb: fix slot alignment checks")
> Cc: Christoph Hellwig <hch@lst.de>
> Cc: Marek Szyprowski <m.szyprowski@samsung.com>
> Cc: Robin Murphy <robin.murphy@arm.com>
> Cc: Dexuan Cui <decui@microsoft.com>
> Reviewed-by: Petr Tesarik <petr.tesarik1@huawei-partners.com>
> Tested-by: Nicolin Chen <nicolinc@nvidia.com>
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
> kernel/dma/swiotlb.c | 28 +++++++++++++++-------------
> 1 file changed, 15 insertions(+), 13 deletions(-)
>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
next prev parent reply other threads:[~2024-02-29 5:44 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-28 13:39 [PATCH v5 0/6] Fix double allocation in swiotlb_alloc() Will Deacon
2024-02-28 13:39 ` [PATCH v5 1/6] swiotlb: Fix double-allocation of slots due to broken alignment handling Will Deacon
2024-02-29 5:44 ` Michael Kelley [this message]
2024-02-28 13:39 ` [PATCH v5 2/6] swiotlb: Enforce page alignment in swiotlb_alloc() Will Deacon
2024-02-28 13:39 ` [PATCH v5 3/6] swiotlb: Honour dma_alloc_coherent() " Will Deacon
2024-02-28 13:39 ` [PATCH v5 4/6] swiotlb: Fix alignment checks when both allocation and DMA masks are present Will Deacon
2024-02-28 13:39 ` [PATCH v5 5/6] iommu/dma: Force swiotlb_max_mapping_size on an untrusted device Will Deacon
2024-02-29 5:57 ` Michael Kelley
2024-02-28 13:39 ` [PATCH v5 6/6] swiotlb: Remove pointless stride adjustment for allocations >= PAGE_SIZE Will Deacon
2024-02-29 6:07 ` Michael Kelley
2024-02-29 7:36 ` Michael Kelley
2024-02-29 13:33 ` Christoph Hellwig
2024-02-29 15:44 ` Michael Kelley
2024-02-29 15:47 ` Christoph Hellwig
2024-03-01 15:39 ` Petr Tesařík
2024-03-01 16:38 ` Robin Murphy
2024-03-01 17:33 ` Petr Tesařík
2024-03-01 17:08 ` Petr Tesařík
2024-03-01 17:54 ` Robin Murphy
2024-03-01 18:42 ` Petr Tesařík
2024-03-04 3:31 ` Michael Kelley
2024-03-04 11:00 ` Petr Tesařík
2024-03-04 13:37 ` Robin Murphy
2024-03-04 15:55 ` Petr Tesařík
2024-03-04 16:02 ` Will Deacon
2024-03-04 16:10 ` Michael Kelley
2024-03-04 16:53 ` Robin Murphy
2024-03-04 18:22 ` Michael Kelley
2024-03-05 11:20 ` Robin Murphy
2024-03-05 15:15 ` Petr Tesařík
2024-03-04 19:04 ` Petr Tesařík
2024-03-05 14:08 ` Christoph Hellwig
2024-03-04 16:04 ` Michael Kelley
2024-03-04 17:11 ` Robin Murphy
2024-03-04 18:08 ` Michael Kelley
2024-03-05 14:05 ` Christoph Hellwig
2024-03-04 15:32 ` Will Deacon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=SN6PR02MB4157412391D227828548F0F5D45F2@SN6PR02MB4157.namprd02.prod.outlook.com \
--to=mhklinux@outlook.com \
--cc=decui@microsoft.com \
--cc=hch@lst.de \
--cc=iommu@lists.linux.dev \
--cc=kernel-team@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=nicolinc@nvidia.com \
--cc=petr.tesarik1@huawei-partners.com \
--cc=robin.murphy@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).