Re: dmapool regression in next

From: Tony Lindgren <tony@atomide.com>
To: Tony Battersby <tonyb@cybernetics.com>
Cc: Robin Murphy <robin.murphy@arm.com>,
	Krzysztof Kozlowski <krzk@kernel.org>,
	akpm@linux-foundation.org,
	Stephen Rothwell <sfr@canb.auug.org.au>,
	john.garry@huawei.com, linux@armlinux.org.uk,
	linux-kernel@vger.kernel.org, andy.shevchenko@gmail.com,
	linux-omap@vger.kernel.org, hch@lst.de,
	linux-arm-kernel@lists.infradead.org,
	Marek Szyprowski <m.szyprowski@samsung.com>,
	Matthew Wilcox <willy@infradead.org>
Subject: Re: dmapool regression in next
Date: Thu, 6 Dec 2018 08:33:15 -0800	[thread overview]
Message-ID: <20181206163315.GL6707@atomide.com> (raw)
In-Reply-To: <9187bbd9-3aaf-c1b3-16a3-4e1b3356c52e@cybernetics.com>

* Tony Battersby <tonyb@cybernetics.com> [181206 16:13]:
> On 12/6/18 10:51 AM, Robin Murphy wrote:
> >> Here is the prototype:
> >>
> >> void dma_pool_free(struct dma_pool *pool, void *vaddr, dma_addr_t dma);
> >>
> >> With the old code, the 'dma' value had to be correct for use with
> >> pool_find_page(), or else you would get an error.  If the 'vaddr' value
> >> was incorrect, it would corrupt the dmapool freelist, but you wouldn't
> >> get an error unless DMAPOOL_DEBUG was enabled.
> >>
> >> With my patch applied, 'vaddr' has to be correct for virt_to_page().  My
> >> code also checks that 'dma' is consistent with 'vaddr' even if
> >> DMAPOOL_DEBUG is disabled, since the check is fast and it will prevent
> >> problems like this in the future.
> > Unfortunately that logic has a fatal flaw - DMA pools are backed by 
> > dma_alloc_coherent(), and there is absolutely no guarantee that the 
> > memory dma_alloc_coherent() returns is backed by a struct page at all. 
> > Even if it is, there is still absolutely no guarantee that the vaddr 
> > value it returns is valid for virt_to_page() - on many systems it will 
> > be in vmalloc or some architecture-specific region of address space.
> >
> > The problem is not that these drivers are buggy (they're not - the arch 
> > code is returning a vmalloc()ed non-cacheable remap in the first place), 
> > it's that 26abe88e830d is fundamentally unworkable and needs reverting. 
> > Apparently the original patches managed not to catch my eye as something 
> > I needed to review, sorry about that :(
> >
> > Robin.
> >
> Thanks for the info; the inner workings of the vm system are a bit out
> of my area of expertise.  My first version of the patch series used a
> different method that didn't rely on virt_to_page(); I will go back to
> that version, clean it up, and resubmit when I have time.
> 
> Andrew, please revert all 9 patches.  I will resubmit the set when I
> have a workable solution.

OK sounds good to me. I can test the new set easily when available
if you Cc me on them.

Thanks,

Tony