[PATCH v3] ARM: Fix MAX_DMA_ADDRESS overflow

[PATCH v3] ARM: Fix MAX_DMA_ADDRESS overflow

[Florian Fainelli]

Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
added a check to determine whether arm_dma_zone_size is exceeding the
amount of kernel virtual address space available between the upper 4GB
virtual address limit and PAGE_OFFSET in order to provide a suitable
definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual
address space. The quantity used for comparison was off by a missing
trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit
quantity.

This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform
where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value
of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being
0x1_0000_0000 which overflows the unsigned long type used throughout
__pa() and then __virt_addr_valid(). Because the virtual address passed
to __virt_addr_valid() would now be 0, the function would loudly warn
and flood the kernel log, thus making the platform unable to boot
properly.

Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
Changes in v3:

- added ULL suffix to the constant
- reworded the commit message to be clearer

Changes in v2:

- simplify the patch and drop the first patch that attempted to fix an
  off by one in the calculation.

 arch/arm/include/asm/dma.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/include/asm/dma.h b/arch/arm/include/asm/dma.h
index a81dda65c576..45180a2cc47c 100644
--- a/arch/arm/include/asm/dma.h
+++ b/arch/arm/include/asm/dma.h
@@ -10,7 +10,7 @@
 #else
 #define MAX_DMA_ADDRESS	({ \
 	extern phys_addr_t arm_dma_zone_size; \
-	arm_dma_zone_size && arm_dma_zone_size < (0x10000000 - PAGE_OFFSET) ? \
+	arm_dma_zone_size && arm_dma_zone_size < (0x100000000ULL - PAGE_OFFSET) ? \
 		(PAGE_OFFSET + arm_dma_zone_size) : 0xffffffffUL; })
 #endif
 
-- 
2.25.1

Re: [PATCH v3] ARM: Fix MAX_DMA_ADDRESS overflow

[Florian Fainelli]

On 7/6/22 13:33, Florian Fainelli wrote:
> Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
> added a check to determine whether arm_dma_zone_size is exceeding the
> amount of kernel virtual address space available between the upper 4GB
> virtual address limit and PAGE_OFFSET in order to provide a suitable
> definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual
> address space. The quantity used for comparison was off by a missing
> trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit
> quantity.
> 
> This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform
> where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value
> of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being
> 0x1_0000_0000 which overflows the unsigned long type used throughout
> __pa() and then __virt_addr_valid(). Because the virtual address passed
> to __virt_addr_valid() would now be 0, the function would loudly warn
> and flood the kernel log, thus making the platform unable to boot
> properly.
> 
> Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>

Shall I send this to RMK's patch system?
-- 
Florian

Re: [PATCH v3] ARM: Fix MAX_DMA_ADDRESS overflow

[Linus Walleij]

On Thu, Jul 14, 2022 at 1:28 AM Florian Fainelli <f.fainelli@gmail.com> wrote:
> On 7/6/22 13:33, Florian Fainelli wrote:
> > Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
> > added a check to determine whether arm_dma_zone_size is exceeding the
> > amount of kernel virtual address space available between the upper 4GB
> > virtual address limit and PAGE_OFFSET in order to provide a suitable
> > definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual
> > address space. The quantity used for comparison was off by a missing
> > trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit
> > quantity.
> >
> > This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform
> > where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value
> > of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being
> > 0x1_0000_0000 which overflows the unsigned long type used throughout
> > __pa() and then __virt_addr_valid(). Because the virtual address passed
> > to __virt_addr_valid() would now be 0, the function would loudly warn
> > and flood the kernel log, thus making the platform unable to boot
> > properly.
> >
> > Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
> > Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
>
> Shall I send this to RMK's patch system?

I think so!
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

Yours,
Linus Walleij

Re: [PATCH v3] ARM: Fix MAX_DMA_ADDRESS overflow

[Florian Fainelli]

On 7/18/2022 5:53 AM, Linus Walleij wrote:
> On Thu, Jul 14, 2022 at 1:28 AM Florian Fainelli <f.fainelli@gmail.com> wrote:
>> On 7/6/22 13:33, Florian Fainelli wrote:
>>> Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
>>> added a check to determine whether arm_dma_zone_size is exceeding the
>>> amount of kernel virtual address space available between the upper 4GB
>>> virtual address limit and PAGE_OFFSET in order to provide a suitable
>>> definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual
>>> address space. The quantity used for comparison was off by a missing
>>> trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit
>>> quantity.
>>>
>>> This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform
>>> where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value
>>> of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being
>>> 0x1_0000_0000 which overflows the unsigned long type used throughout
>>> __pa() and then __virt_addr_valid(). Because the virtual address passed
>>> to __virt_addr_valid() would now be 0, the function would loudly warn
>>> and flood the kernel log, thus making the platform unable to boot
>>> properly.
>>>
>>> Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
>>> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
>>
>> Shall I send this to RMK's patch system?
> 
> I think so!
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

Thanks:

https://www.armlinux.org.uk/developer/patches/viewpatch.php?id=9216/1
-- 
Florian