From mboxrd@z Thu Jan 1 00:00:00 1970 From: mina86@mina86.com (Michal Nazarewicz) Date: Fri, 19 Feb 2016 14:50:52 +0100 Subject: [PATCH 2/2] ARM: dma-mapping: fix alloc/free for coherent + CMA + gfp=0 In-Reply-To: <1455869524-13874-2-git-send-email-rabin.vincent@axis.com> References: <1455869524-13874-1-git-send-email-rabin.vincent@axis.com> <1455869524-13874-2-git-send-email-rabin.vincent@axis.com> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Fri, Feb 19 2016, Rabin Vincent wrote: > Given a device which uses arm_coherent_dma_ops and on which > dev_get_cma_area(dev) returns non-NULL, the following usage of the DMA > API with gfp=0 results in a memory leak and memory corruption. > > p = dma_alloc_coherent(dev, sz, &dma, 0); > if (p) > dma_free_coherent(dev, sz, p, dma); > > The memory leak is because the alloc allocates using > __alloc_simple_buffer() but the free attempts > dma_release_from_contiguous(), which does not do free anything since the > page is not in the CMA area. > > The memory corruption is because the free calls __dma_remap() on a page > which is backed by only first level page tables. The > apply_to_page_range() + __dma_update_pte() loop ends up interpreting the > section mapping as the address to a second level page table and writing > the new PTE to memory which is not used by page tables. > > We don't have access to the GFP flags used for allocation in the free > function, so fix it by using the new in_cma() function to determine if a > buffer was allocated with CMA, similar to how we check for > __in_atomic_pool(). > > Fixes: 21caf3a7 ("ARM: 8398/1: arm DMA: Fix allocation from CMA for coherent DMA") > Signed-off-by: Rabin Vincent > --- > arch/arm/mm/dma-mapping.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index 0eca381..a4592c7 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c > @@ -749,16 +749,16 @@ static void __arm_dma_free(struct device *dev, size_t size, void *cpu_addr, > __dma_free_buffer(page, size); > } else if (!is_coherent && __free_from_pool(cpu_addr, size)) { > return; > - } else if (!dev_get_cma_area(dev)) { > - if (want_vaddr && !is_coherent) > - __dma_free_remap(cpu_addr, size); > - __dma_free_buffer(page, size); > - } else { > + } else if (in_cma(dev_get_cma_area(dev), page, size >> PAGE_SHIFT)) { > /* > * Non-atomic allocations cannot be freed with IRQs disabled > */ > WARN_ON(irqs_disabled()); > __free_from_contiguous(dev, page, cpu_addr, size, want_vaddr); > + } else { > + if (want_vaddr && !is_coherent) > + __dma_free_remap(cpu_addr, size); > + __dma_free_buffer(page, size); > } > } I haven?t looked closely at the code, but why not: struct cma *cma = if (!cma_release(dev_get_cma_area(dev), page, size >> PAGE_SHIFT)) { // ... do whatever other non-CMA free } -- Best regards Liege of Serenely Enlightened Majesty of Computer Science, ??? ?mina86? ?????? From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f43.google.com (mail-wm0-f43.google.com [74.125.82.43]) by kanga.kvack.org (Postfix) with ESMTP id B1C0F6B0009 for ; Fri, 19 Feb 2016 08:50:55 -0500 (EST) Received: by mail-wm0-f43.google.com with SMTP id a4so71605408wme.1 for ; Fri, 19 Feb 2016 05:50:55 -0800 (PST) Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com. [2a00:1450:400c:c09::235]) by mx.google.com with ESMTPS id b63si12876924wma.98.2016.02.19.05.50.54 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 19 Feb 2016 05:50:54 -0800 (PST) Received: by mail-wm0-x235.google.com with SMTP id a4so71604910wme.1 for ; Fri, 19 Feb 2016 05:50:54 -0800 (PST) From: Michal Nazarewicz Subject: Re: [PATCH 2/2] ARM: dma-mapping: fix alloc/free for coherent + CMA + gfp=0 In-Reply-To: <1455869524-13874-2-git-send-email-rabin.vincent@axis.com> References: <1455869524-13874-1-git-send-email-rabin.vincent@axis.com> <1455869524-13874-2-git-send-email-rabin.vincent@axis.com> Date: Fri, 19 Feb 2016 14:50:52 +0100 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sender: owner-linux-mm@kvack.org List-ID: To: Rabin Vincent , linux@arm.linux.org.uk Cc: akpm@linux-foundation.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Rabin Vincent On Fri, Feb 19 2016, Rabin Vincent wrote: > Given a device which uses arm_coherent_dma_ops and on which > dev_get_cma_area(dev) returns non-NULL, the following usage of the DMA > API with gfp=3D0 results in a memory leak and memory corruption. > > p =3D dma_alloc_coherent(dev, sz, &dma, 0); > if (p) > dma_free_coherent(dev, sz, p, dma); > > The memory leak is because the alloc allocates using > __alloc_simple_buffer() but the free attempts > dma_release_from_contiguous(), which does not do free anything since the > page is not in the CMA area. > > The memory corruption is because the free calls __dma_remap() on a page > which is backed by only first level page tables. The > apply_to_page_range() + __dma_update_pte() loop ends up interpreting the > section mapping as the address to a second level page table and writing > the new PTE to memory which is not used by page tables. > > We don't have access to the GFP flags used for allocation in the free > function, so fix it by using the new in_cma() function to determine if a > buffer was allocated with CMA, similar to how we check for > __in_atomic_pool(). > > Fixes: 21caf3a7 ("ARM: 8398/1: arm DMA: Fix allocation from CMA for coher= ent DMA") > Signed-off-by: Rabin Vincent > --- > arch/arm/mm/dma-mapping.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index 0eca381..a4592c7 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c > @@ -749,16 +749,16 @@ static void __arm_dma_free(struct device *dev, size= _t size, void *cpu_addr, > __dma_free_buffer(page, size); > } else if (!is_coherent && __free_from_pool(cpu_addr, size)) { > return; > - } else if (!dev_get_cma_area(dev)) { > - if (want_vaddr && !is_coherent) > - __dma_free_remap(cpu_addr, size); > - __dma_free_buffer(page, size); > - } else { > + } else if (in_cma(dev_get_cma_area(dev), page, size >> PAGE_SHIFT)) { > /* > * Non-atomic allocations cannot be freed with IRQs disabled > */ > WARN_ON(irqs_disabled()); > __free_from_contiguous(dev, page, cpu_addr, size, want_vaddr); > + } else { > + if (want_vaddr && !is_coherent) > + __dma_free_remap(cpu_addr, size); > + __dma_free_buffer(page, size); > } > } I haven=E2=80=99t looked closely at the code, but why not: struct cma *cma =3D=20 if (!cma_release(dev_get_cma_area(dev), page, size >> PAGE_SHIFT)) { // ... do whatever other non-CMA free } --=20 Best regards Liege of Serenely Enlightened Majesty of Computer Science, =E3=83=9F=E3=83=8F=E3=82=A6 =E2=80=9Cmina86=E2=80=9D =E3=83=8A=E3=82=B6=E3= =83=AC=E3=83=B4=E3=82=A4=E3=83=84 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1947567AbcBSNu5 (ORCPT ); Fri, 19 Feb 2016 08:50:57 -0500 Received: from mail-wm0-f50.google.com ([74.125.82.50]:34919 "EHLO mail-wm0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1424447AbcBSNuz convert rfc822-to-8bit (ORCPT ); Fri, 19 Feb 2016 08:50:55 -0500 From: Michal Nazarewicz To: Rabin Vincent , linux@arm.linux.org.uk Cc: akpm@linux-foundation.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Rabin Vincent Subject: Re: [PATCH 2/2] ARM: dma-mapping: fix alloc/free for coherent + CMA + gfp=0 In-Reply-To: <1455869524-13874-2-git-send-email-rabin.vincent@axis.com> Organization: http://mina86.com/ References: <1455869524-13874-1-git-send-email-rabin.vincent@axis.com> <1455869524-13874-2-git-send-email-rabin.vincent@axis.com> User-Agent: Notmuch/0.19+53~g2e63a09 (http://notmuchmail.org) Emacs/25.1.50.1 (x86_64-unknown-linux-gnu) Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAJFBMVEWbfGlUPDDHgE57V0jUupKjgIObY0PLrom9mH4dFRK4gmjPs41MxjOgAAACP0lEQVQ4T23Sv2vbQBQHcBk1xE6WyALX107VUEgmn6+ouUwpEQQ6uRjttkWP4CkBg2M0BQLBdPFZYPsyFYo7qEtKDQ7on+t7+nF2Ux8ahD587717OmNYrOvycHsZ+o2r051wHTHysAvGb8ygvgu4QWT0sCmkgZCIEnlV2X8BtyraazFGDuxhmKSQJMlwHQ7v5MHSNxmz78rfElwAa3ieVD9e+hBhjaPDDG6NgFo2f4wBMNIo5YmRtF0RyDgFjJjlMIWbnuM4x9MMfABGTlN4qgIQB4A1DEyA1BHWtfeWNUMwiVJKoqh97KrkOO+qzgluVYLvFCUKAX73nONeBr7BGMdM6Sg0kuep03VywLaIzRiVr+GAzKlpQIsAFnWAG2e6DT5WmWDiudZMIc6hYrMOmeMQK9WX0B+/RfjzL9DI7Y9/Iayn29Ci0r2i4f9gMimMSZLCDMalgQGU5hnUtqAN0OGvEmO1Wnl0C0wWSCEHnuHBqmygxdxA8oWXwbipoc1EoNR9DqOpBpOJrnr0criQab9ZT4LL+wI+K7GBQH30CrhUruilgP9DRTrhVWZCiAyILP+wiuLeCKGTD6r/nc8LOJcAwR6IBTUs+7CASw3QFZ0MdA2PI3zNziH4ZKVhXCRMBjeZ1DWMekKwDCASwExy+NQ86TaykaDAFHO4aP48y4fIcDM5yOG8GcTLbOyp8A8azjJI93JFd1EA6yN8sSxMQJWoABqniRZVykYgRXErzrdqExAoUrRb0xfRp8p2A/4XmfilTtkDZ4cAAAAASUVORK5CYII= X-Face: -TR8(rDTHy/(xl?SfWd1|3:TTgDIatE^t'vop%*gVg[kn$t{EpK(P"VQ=~T2#ysNmJKN$"yTRLB4YQs$4{[.]Fc1)*O]3+XO^oXM>Q#b^ix,O)Zbn)q[y06$`e3?C)`CwR9y5riE=fv^X@x$y?D:XO6L&x4f-}}I4=VRNwiA^t1-ZrVK^07.Pi/57c_du'& X-PGP: 50751FF4 X-PGP-FP: AC1F 5F5C D418 88F8 CC84 5858 2060 4012 5075 1FF4 X-Hashcash: 1:20:160219:rabin.vincent@axis.com::piidkwHEsog6nZ/u:0000000000000000000000000000000000000000IOd X-Hashcash: 1:20:160219:linux-kernel@vger.kernel.org::BzjFUlaNxFi0Akoo:0000000000000000000000000000000002nNU X-Hashcash: 1:20:160219:linux-mm@kvack.org::0nMA+rMeK7iRbI5A:000000000000000000000000000000000000000000064xr X-Hashcash: 1:20:160219:akpm@linux-foundation.org::v1SIFAhqxPCnfzJR:0000000000000000000000000000000000006dW9 X-Hashcash: 1:20:160219:rabinv@axis.com::mWwi3NJLxio9DOy3:004WCv X-Hashcash: 1:20:160219:linux-arm-kernel@lists.infradead.org::2VPiymOcprYv7VRk:000000000000000000000000059DU X-Hashcash: 1:20:160219:linux@arm.linux.org.uk::ZZx2UMnGfBCnV6rH:0000000000000000000000000000000000000007SxW Date: Fri, 19 Feb 2016 14:50:52 +0100 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Feb 19 2016, Rabin Vincent wrote: > Given a device which uses arm_coherent_dma_ops and on which > dev_get_cma_area(dev) returns non-NULL, the following usage of the DMA > API with gfp=0 results in a memory leak and memory corruption. > > p = dma_alloc_coherent(dev, sz, &dma, 0); > if (p) > dma_free_coherent(dev, sz, p, dma); > > The memory leak is because the alloc allocates using > __alloc_simple_buffer() but the free attempts > dma_release_from_contiguous(), which does not do free anything since the > page is not in the CMA area. > > The memory corruption is because the free calls __dma_remap() on a page > which is backed by only first level page tables. The > apply_to_page_range() + __dma_update_pte() loop ends up interpreting the > section mapping as the address to a second level page table and writing > the new PTE to memory which is not used by page tables. > > We don't have access to the GFP flags used for allocation in the free > function, so fix it by using the new in_cma() function to determine if a > buffer was allocated with CMA, similar to how we check for > __in_atomic_pool(). > > Fixes: 21caf3a7 ("ARM: 8398/1: arm DMA: Fix allocation from CMA for coherent DMA") > Signed-off-by: Rabin Vincent > --- > arch/arm/mm/dma-mapping.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index 0eca381..a4592c7 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c > @@ -749,16 +749,16 @@ static void __arm_dma_free(struct device *dev, size_t size, void *cpu_addr, > __dma_free_buffer(page, size); > } else if (!is_coherent && __free_from_pool(cpu_addr, size)) { > return; > - } else if (!dev_get_cma_area(dev)) { > - if (want_vaddr && !is_coherent) > - __dma_free_remap(cpu_addr, size); > - __dma_free_buffer(page, size); > - } else { > + } else if (in_cma(dev_get_cma_area(dev), page, size >> PAGE_SHIFT)) { > /* > * Non-atomic allocations cannot be freed with IRQs disabled > */ > WARN_ON(irqs_disabled()); > __free_from_contiguous(dev, page, cpu_addr, size, want_vaddr); > + } else { > + if (want_vaddr && !is_coherent) > + __dma_free_remap(cpu_addr, size); > + __dma_free_buffer(page, size); > } > } I haven’t looked closely at the code, but why not: struct cma *cma = if (!cma_release(dev_get_cma_area(dev), page, size >> PAGE_SHIFT)) { // ... do whatever other non-CMA free } -- Best regards Liege of Serenely Enlightened Majesty of Computer Science, ミハウ “mina86” ナザレヴイツ