From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B8E5C4CECE for ; Mon, 14 Oct 2019 18:32:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5AC4220873 for ; Mon, 14 Oct 2019 18:32:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388845AbfJNScA (ORCPT ); Mon, 14 Oct 2019 14:32:00 -0400 Received: from mx2.suse.de ([195.135.220.15]:42782 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2388796AbfJNSbx (ORCPT ); Mon, 14 Oct 2019 14:31:53 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id E3DD2BB7F; Mon, 14 Oct 2019 18:31:51 +0000 (UTC) From: Nicolas Saenz Julienne To: Robin Murphy , linux-arm-kernel@lists.infradead.org, bcm-kernel-feedback-list@broadcom.com, linux-rpi-kernel@lists.infradead.org, iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org Cc: hch@infradead.org, mbrugger@suse.com, f.fainelli@gmail.com, wahrenst@gmx.net, Nicolas Saenz Julienne , Russell King Subject: [PATCH RFC 4/5] dma/direct: check for overflows in ARM's dma_capable() Date: Mon, 14 Oct 2019 20:31:06 +0200 Message-Id: <20191014183108.24804-5-nsaenzjulienne@suse.de> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191014183108.24804-1-nsaenzjulienne@suse.de> References: <20191014183108.24804-1-nsaenzjulienne@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The Raspberry Pi 4 has a 1GB ZONE_DMA area starting at address 0x00000000 and a mapping between physical and DMA memory offset by 0xc0000000. It transpires that, on non LPAE systems, any attempt to translate physical addresses outside of ZONE_DMA will result in an overflow. The resulting DMA addresses will not be detected by arm's dma_capable() as they still fit in the device's DMA mask. Fix this by failing to validate a DMA address smaller than the lowest possible DMA address. Signed-off-by: Nicolas Saenz Julienne --- arch/arm/include/asm/dma-direct.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm/include/asm/dma-direct.h b/arch/arm/include/asm/dma-direct.h index b67e5fc1fe43..ee8ad47a14e3 100644 --- a/arch/arm/include/asm/dma-direct.h +++ b/arch/arm/include/asm/dma-direct.h @@ -2,6 +2,8 @@ #ifndef ASM_ARM_DMA_DIRECT_H #define ASM_ARM_DMA_DIRECT_H 1 +#include + static inline dma_addr_t __phys_to_dma(struct device *dev, phys_addr_t paddr) { unsigned int offset = paddr & ~PAGE_MASK; @@ -21,6 +23,10 @@ static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size) if (!dev->dma_mask) return 0; + /* Check if address overflowed */ + if (addr < __phys_to_dma(dev, PFN_UP(min_low_pfn))) + return 0; + mask = *dev->dma_mask; limit = (mask + 1) & ~mask; -- 2.23.0