[PATCH] spi: Assign dummy scatterlist to unidirectional transfers

[PATCH] spi: Assign dummy scatterlist to unidirectional transfers

[Nícolas F. R. A. Prado]

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

Commit 8cc3bad9d9d6 ("spi: Remove unneded check for orig_nents")
introduced a regression: unmapped data could now be passed to the DMA
APIs, resulting in null pointer dereferences. Commit 9f788ba457b4 ("spi:
Don't mark message DMA mapped when no transfer in it is") and commit
da560097c056 ("spi: Check if transfer is mapped before calling DMA sync
APIs") addressed the problem, but only partially. Unidirectional
transactions will still result in null pointer dereference. To prevent
that from happening, assign a dummy scatterlist when no data is mapped,
so that the DMA API can be called and not result in a null pointer
dereference.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reported-by: Neil Armstrong <neil.armstrong@linaro.org>
Closes: https://lore.kernel.org/r/8ae675b5-fcf9-4c9b-b06a-4462f70e1322@linaro.org
Reported-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Closes: https://lore.kernel.org/all/d3679496-2e4e-4a7c-97ed-f193bd53af1d@notapiano
Closes: https://lore.kernel.org/all/4748499f-789c-45a8-b50a-2dd09f4bac8c@notapiano
Fixes: 8cc3bad9d9d6 ("spi: Remove unneded check for orig_nents")
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
[nfraprado: wrote the commit message]
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
---
 drivers/spi/spi.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index f94420858c22..9bc9fd10d538 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1220,6 +1220,11 @@ void spi_unmap_buf(struct spi_controller *ctlr, struct device *dev,
 	spi_unmap_buf_attrs(ctlr, dev, sgt, dir, 0);
 }
 
+/* Dummy SG for unidirect transfers */
+static struct scatterlist dummy_sg = {
+	.page_link = SG_END,
+};
+
 static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 {
 	struct device *tx_dev, *rx_dev;
@@ -1258,6 +1263,8 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 						attrs);
 			if (ret != 0)
 				return ret;
+		} else {
+			xfer->tx_sg.sgl = &dummy_sg;
 		}
 
 		if (xfer->rx_buf != NULL) {
@@ -1271,6 +1278,8 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 
 				return ret;
 			}
+		} else {
+			xfer->rx_sg.sgl = &dummy_sg;
 		}
 	}
 	/* No transfer has been mapped, bail out with success */

---
base-commit: 9d99040b1bc8dbf385a8aa535e9efcdf94466e19
change-id: 20240529-dma-oops-dummy-2cbf8cbaec54

Best regards,
-- 
Nícolas F. R. A. Prado <nfraprado@collabora.com>

Re: [PATCH] spi: Assign dummy scatterlist to unidirectional transfers

[Mark Brown]

On Wed, 29 May 2024 11:42:35 -0400, Nícolas F. R. A. Prado wrote:
> Commit 8cc3bad9d9d6 ("spi: Remove unneded check for orig_nents")
> introduced a regression: unmapped data could now be passed to the DMA
> APIs, resulting in null pointer dereferences. Commit 9f788ba457b4 ("spi:
> Don't mark message DMA mapped when no transfer in it is") and commit
> da560097c056 ("spi: Check if transfer is mapped before calling DMA sync
> APIs") addressed the problem, but only partially. Unidirectional
> transactions will still result in null pointer dereference. To prevent
> that from happening, assign a dummy scatterlist when no data is mapped,
> so that the DMA API can be called and not result in a null pointer
> dereference.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next

Thanks!

[1/1] spi: Assign dummy scatterlist to unidirectional transfers
      commit: 9dedabe95b49ec9b0d16ce8f0ed1f9a12dd4a040

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

Re: [PATCH] spi: Assign dummy scatterlist to unidirectional transfers

[Andy Shevchenko]

Wed, May 29, 2024 at 11:42:35AM -0400, Nícolas F. R. A. Prado kirjoitti:
> From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> 
> Commit 8cc3bad9d9d6 ("spi: Remove unneded check for orig_nents")
> introduced a regression: unmapped data could now be passed to the DMA
> APIs, resulting in null pointer dereferences. Commit 9f788ba457b4 ("spi:
> Don't mark message DMA mapped when no transfer in it is") and commit
> da560097c056 ("spi: Check if transfer is mapped before calling DMA sync
> APIs") addressed the problem, but only partially. Unidirectional
> transactions will still result in null pointer dereference. To prevent
> that from happening, assign a dummy scatterlist when no data is mapped,
> so that the DMA API can be called and not result in a null pointer
> dereference.

I feel that with this the da560097c056 ("spi: Check if transfer is mapped
before calling DMA sync APIs") can be reverted as unneeded. Nícolas, can
you check that? If it works, we better revert the unneeded checks.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] spi: Assign dummy scatterlist to unidirectional transfers

[Yongqin Liu]

On Thu, 30 May 2024 at 05:04, Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
>
> Wed, May 29, 2024 at 11:42:35AM -0400, Nícolas F. R. A. Prado kirjoitti:
> > From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> >
> > Commit 8cc3bad9d9d6 ("spi: Remove unneded check for orig_nents")
> > introduced a regression: unmapped data could now be passed to the DMA
> > APIs, resulting in null pointer dereferences. Commit 9f788ba457b4 ("spi:
> > Don't mark message DMA mapped when no transfer in it is") and commit
> > da560097c056 ("spi: Check if transfer is mapped before calling DMA sync
> > APIs") addressed the problem, but only partially. Unidirectional
> > transactions will still result in null pointer dereference. To prevent
> > that from happening, assign a dummy scatterlist when no data is mapped,
> > so that the DMA API can be called and not result in a null pointer
> > dereference.
>
> I feel that with this the da560097c056 ("spi: Check if transfer is mapped
> before calling DMA sync APIs") can be reverted as unneeded. Nícolas, can
> you check that? If it works, we better revert the unneeded checks.

FYI, just tested based on the Android Common Kernel android-mainline branch,
with only the following two changes, the issue is not reported too:
    9dedabe95b49 spi: Assign dummy scatterlist to unidirectional transfers
    9f788ba457b4 spi: Don't mark message DMA mapped when no transfer in it is


-- 
Best Regards,
Yongqin Liu
---------------------------------------------------------------
#mailing list
linaro-android@lists.linaro.org
http://lists.linaro.org/mailman/listinfo/linaro-android

Re: [PATCH] spi: Assign dummy scatterlist to unidirectional transfers

[Nícolas F. R. A. Prado]

On Tue, Jul 23, 2024 at 12:05:52AM +0800, Yongqin Liu wrote:
> On Thu, 30 May 2024 at 05:04, Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
> >
> > Wed, May 29, 2024 at 11:42:35AM -0400, Nícolas F. R. A. Prado kirjoitti:
> > > From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> > >
> > > Commit 8cc3bad9d9d6 ("spi: Remove unneded check for orig_nents")
> > > introduced a regression: unmapped data could now be passed to the DMA
> > > APIs, resulting in null pointer dereferences. Commit 9f788ba457b4 ("spi:
> > > Don't mark message DMA mapped when no transfer in it is") and commit
> > > da560097c056 ("spi: Check if transfer is mapped before calling DMA sync
> > > APIs") addressed the problem, but only partially. Unidirectional
> > > transactions will still result in null pointer dereference. To prevent
> > > that from happening, assign a dummy scatterlist when no data is mapped,
> > > so that the DMA API can be called and not result in a null pointer
> > > dereference.
> >
> > I feel that with this the da560097c056 ("spi: Check if transfer is mapped
> > before calling DMA sync APIs") can be reverted as unneeded. Nícolas, can
> > you check that? If it works, we better revert the unneeded checks.
> 
> FYI, just tested based on the Android Common Kernel android-mainline branch,
> with only the following two changes, the issue is not reported too:
>     9dedabe95b49 spi: Assign dummy scatterlist to unidirectional transfers
>     9f788ba457b4 spi: Don't mark message DMA mapped when no transfer in it is

Hi Yongqin,

Simply reverting commit da560097c056 ("spi: Check if transfer is mapped before
calling DMA sync APIs") caused issues on the sc7180-limozeen platform as I
mentioned in
https://lore.kernel.org/all/1ea41944-a107-4528-8e8d-559c06907e3f@notapiano/.

Instead of that, Andy landed this commit reworking the flag, which got rid of
that check anyway and provided a cleaner solution:
https://lore.kernel.org/all/20240531194723.1761567-9-andriy.shevchenko@linux.intel.com/

Thanks,
Nícolas