[PATCH] dma-buf: enable sg_table wrapping on CONFIG_DEBUG

[PATCH] dma-buf: enable sg_table wrapping on CONFIG_DEBUG

[Christian König]

Importers notoriously abused the struct page pointers from the sg_table the
DMA-buf exporter provides. This has created numerous problems ranging from
crashes over random memory corruption to security issues.

To find such bad importers DMA-buf already has a functionality to wrap the
sg_table and set the page pointers to NULL enabled under CONFIG_DMABUF_DEBUG.

Change that to just CONFIG_DEBUG to catch even more importers doing something
nasty.

Signed-off-by: Christian König <christian.koenig@amd.com>
---
 drivers/dma-buf/dma-buf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 71f37544a5c6..d5dfa82ed2dd 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -857,7 +857,7 @@ static int dma_buf_wrap_sg_table(struct sg_table **sg_table)
 	struct dma_buf_sg_table_wrapper *to;
 	int i, ret;
 
-	if (!IS_ENABLED(CONFIG_DMABUF_DEBUG))
+	if (!IS_ENABLED(CONFIG_DEBUG))
 		return 0;
 
 	/*
@@ -896,7 +896,7 @@ static void dma_buf_unwrap_sg_table(struct sg_table **sg_table)
 {
 	struct dma_buf_sg_table_wrapper *copy;
 
-	if (!IS_ENABLED(CONFIG_DMABUF_DEBUG))
+	if (!IS_ENABLED(CONFIG_DEBUG))
 		return;
 
 	copy = container_of(*sg_table, typeof(*copy), wrapper);
-- 
2.43.0

Re: [PATCH] dma-buf: enable sg_table wrapping on CONFIG_DEBUG

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `dma_buf_wrap_sg_table()` and `dma_buf_unwrap_sg_table()` functions incorrectly check for `CONFIG_DEBUG`, which is not a valid or defined Kconfig option, unconditionally disabling the feature.
--

commit b10cbc45f527d11143178ac04d087f2e2061de9c
Author: Christian König <ckoenig.leichtzumerken@gmail.com>

dma-buf: enable sg_table wrapping on CONFIG_DEBUG

This commit changes the conditional for wrapping sg_tables from
CONFIG_DMABUF_DEBUG to CONFIG_DEBUG. The intent is to catch bad
importers doing nasty things by broadening when this feature is enabled.

> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index d504c636dc294..9caef606fba14 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -861,7 +861,7 @@ static int dma_buf_wrap_sg_table(struct sg_table **sg_table)
>  	struct dma_buf_sg_table_wrapper *to;
>  	int i, ret;
>  
> -	if (!IS_ENABLED(CONFIG_DMABUF_DEBUG))
> +	if (!IS_ENABLED(CONFIG_DEBUG))

[Severity: Medium]
Is CONFIG_DEBUG a defined Kconfig option in the kernel? I could not find it.
Since it doesn't exist (unlike CONFIG_DEBUG_KERNEL or CONFIG_DEBUG_FS),
this will unconditionally evaluate to false and completely disable the
wrapping feature. Was a different debug config intended here?

>  		return 0;
>  
>  	/*
[ ... ]
> @@ -900,7 +900,7 @@ static void dma_buf_unwrap_sg_table(struct sg_table **sg_table)
>  {
>  	struct dma_buf_sg_table_wrapper *copy;
>  
> -	if (!IS_ENABLED(CONFIG_DMABUF_DEBUG))
> +	if (!IS_ENABLED(CONFIG_DEBUG))

[Severity: Medium]
Will unwrapping also become permanently disabled here due to the undefined
Kconfig option?

>  		return;
>  
>  	copy = container_of(*sg_table, typeof(*copy), wrapper);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609135939.2606-1-christian.koenig@amd.com?part=1