public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Bumyong Lee" <bumyong.lee@samsung.com>,
	"Chanho Park" <chanho61.park@samsung.com>,
	"Christoph Hellwig" <hch@lst.de>,
	"Dominique MARTINET" <dominique.martinet@atmark-techno.com>,
	"Horia Geantă" <horia.geanta@nxp.com>,
	"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
Subject: [PATCH 5.10 094/101] swiotlb: manipulate orig_addr when tlb_addr has offset
Date: Mon, 28 Jun 2021 10:26:00 -0400	[thread overview]
Message-ID: <20210628142607.32218-95-sashal@kernel.org> (raw)
In-Reply-To: <20210628142607.32218-1-sashal@kernel.org>

From: Bumyong Lee <bumyong.lee@samsung.com>

commit 5f89468e2f060031cd89fd4287298e0eaf246bf6 upstream.

in case of driver wants to sync part of ranges with offset,
swiotlb_tbl_sync_single() copies from orig_addr base to tlb_addr with
offset and ends up with data mismatch.

It was removed from
"swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single",
but said logic has to be added back in.

From Linus's email:
"That commit which the removed the offset calculation entirely, because the old

        (unsigned long)tlb_addr & (IO_TLB_SIZE - 1)

was wrong, but instead of removing it, I think it should have just
fixed it to be

        (tlb_addr - mem->start) & (IO_TLB_SIZE - 1);

instead. That way the slot offset always matches the slot index calculation."

(Unfortunatly that broke NVMe).

The use-case that drivers are hitting is as follow:

1. Get dma_addr_t from dma_map_single()

dma_addr_t tlb_addr = dma_map_single(dev, vaddr, vsize, DMA_TO_DEVICE);

    |<---------------vsize------------->|
    +-----------------------------------+
    |                                   | original buffer
    +-----------------------------------+
  vaddr

 swiotlb_align_offset
     |<----->|<---------------vsize------------->|
     +-------+-----------------------------------+
     |       |                                   | swiotlb buffer
     +-------+-----------------------------------+
          tlb_addr

2. Do something
3. Sync dma_addr_t through dma_sync_single_for_device(..)

dma_sync_single_for_device(dev, tlb_addr + offset, size, DMA_TO_DEVICE);

  Error case.
    Copy data to original buffer but it is from base addr (instead of
  base addr + offset) in original buffer:

 swiotlb_align_offset
     |<----->|<- offset ->|<- size ->|
     +-------+-----------------------------------+
     |       |            |##########|           | swiotlb buffer
     +-------+-----------------------------------+
          tlb_addr

    |<- size ->|
    +-----------------------------------+
    |##########|                        | original buffer
    +-----------------------------------+
  vaddr

The fix is to copy the data to the original buffer and take into
account the offset, like so:

 swiotlb_align_offset
     |<----->|<- offset ->|<- size ->|
     +-------+-----------------------------------+
     |       |            |##########|           | swiotlb buffer
     +-------+-----------------------------------+
          tlb_addr

    |<- offset ->|<- size ->|
    +-----------------------------------+
    |            |##########|           | original buffer
    +-----------------------------------+
  vaddr

[One fix which was Linus's that made more sense to as it created a
symmetry would break NVMe. The reason for that is the:
 unsigned int offset = (tlb_addr - mem->start) & (IO_TLB_SIZE - 1);

would come up with the proper offset, but it would lose the
alignment (which this patch contains).]

Fixes: 16fc3cef33a0 ("swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single")
Signed-off-by: Bumyong Lee <bumyong.lee@samsung.com>
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reported-by: Dominique MARTINET <dominique.martinet@atmark-techno.com>
Reported-by: Horia Geantă <horia.geanta@nxp.com>
Tested-by: Horia Geantă <horia.geanta@nxp.com>
CC: stable@vger.kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/dma/swiotlb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index 0f61b14b0099..0ed0e1f215c7 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -667,6 +667,9 @@ void swiotlb_tbl_sync_single(struct device *hwdev, phys_addr_t tlb_addr,
 	if (orig_addr == INVALID_PHYS_ADDR)
 		return;
 
+	orig_addr += (tlb_addr & (IO_TLB_SIZE - 1)) -
+		swiotlb_align_offset(hwdev, orig_addr);
+
 	switch (target) {
 	case SYNC_FOR_CPU:
 		if (likely(dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL))
-- 
2.30.2


  parent reply	other threads:[~2021-06-28 14:33 UTC|newest]

Thread overview: 116+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-28 14:24 [PATCH 5.10 000/101] 5.10.47-rc1 review Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 001/101] module: limit enabling module.sig_enforce Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 002/101] Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue." Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 003/101] Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell." Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 004/101] drm: add a locked version of drm_is_current_master Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 005/101] drm/nouveau: wait for moving fence after pinning v2 Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 006/101] drm/radeon: wait for moving fence after pinning Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 007/101] drm/amdgpu: " Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 008/101] ARM: 9081/1: fix gcc-10 thumb2-kernel regression Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 009/101] mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 010/101] MIPS: generic: Update node names to avoid unit addresses Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 011/101] arm64: Ignore any DMA offsets in the max_zone_phys() calculation Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 012/101] arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 013/101] spi: spi-nxp-fspi: move the register operation after the clock enable Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 014/101] Revert "PCI: PM: Do not read power state in pci_enable_device_flags()" Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 015/101] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 016/101] drm/vc4: hdmi: Make sure the controller is powered in detect Sasha Levin
2021-07-01 10:15   ` Pavel Machek
2021-06-28 14:24 ` [PATCH 5.10 017/101] x86/entry: Fix noinstr fail in __do_fast_syscall_32() Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 018/101] x86/xen: Fix noinstr fail in exc_xen_unknown_trap() Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 019/101] locking/lockdep: Improve noinstr vs errors Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 020/101] perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 021/101] perf/x86/intel/lbr: Zero the xstate buffer on allocation Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 022/101] dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 023/101] dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc() Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 024/101] dmaengine: xilinx: dpdma: Add missing dependencies to Kconfig Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 025/101] dmaengine: xilinx: dpdma: Limit descriptor IDs to 16 bits Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 026/101] mac80211: remove warning in ieee80211_get_sband() Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 027/101] mac80211_hwsim: drop pending frames on stop Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 028/101] cfg80211: call cfg80211_leave_ocb when switching away from OCB Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 029/101] dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 030/101] dmaengine: mediatek: free the proper desc in desc_free handler Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 031/101] dmaengine: mediatek: do not issue a new desc if one is still current Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 032/101] dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma Sasha Levin
2021-06-28 14:24 ` [PATCH 5.10 033/101] net: ipv4: Remove unneed BUG() function Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 034/101] mac80211: drop multicast fragments Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 035/101] net: ethtool: clear heap allocations for ethtool function Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 036/101] inet: annotate data race in inet_send_prepare() and inet_dgram_connect() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 037/101] ping: Check return value of function 'ping_queue_rcv_skb' Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 038/101] net: annotate data race in sock_error() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 039/101] inet: annotate date races around sk->sk_txhash Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 040/101] net/packet: annotate data race in packet_sendmsg() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 041/101] net: phy: dp83867: perform soft reset and retain established link Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 042/101] riscv32: Use medany C model for modules Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 043/101] net: caif: fix memory leak in ldisc_open Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 044/101] net/packet: annotate accesses to po->bind Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 045/101] net/packet: annotate accesses to po->ifindex Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 046/101] r8152: Avoid memcpy() over-reading of ETH_SS_STATS Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 047/101] sh_eth: " Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 048/101] r8169: " Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 049/101] KVM: selftests: Fix kvm_check_cap() assertion Sasha Levin
2021-07-03 15:21   ` Pavel Machek
2021-07-05  7:10     ` Fuad Tabba
2021-07-05 12:00       ` Paolo Bonzini
2021-06-28 14:25 ` [PATCH 5.10 050/101] net: qed: Fix memcpy() overflow of qed_dcbx_params() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 051/101] mac80211: reset profile_periodicity/ema_ap Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 052/101] mac80211: handle various extensible elements correctly Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 053/101] recordmcount: Correct st_shndx handling Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 054/101] PCI: Add AMD RS690 quirk to enable 64-bit DMA Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 055/101] net: ll_temac: Add memory-barriers for TX BD access Sasha Levin
2021-07-03 15:22   ` Pavel Machek
2021-07-05  7:42     ` Esben Haabendal
2021-06-28 14:25 ` [PATCH 5.10 056/101] net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 057/101] perf/x86: Track pmu in per-CPU cpu_hw_events Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 058/101] pinctrl: stm32: fix the reported number of GPIO lines per bank Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 059/101] i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving i801_access Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 060/101] gpiolib: cdev: zero padding during conversion to gpioline_info_changed Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 061/101] scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART) Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 062/101] nilfs2: fix memory leak in nilfs_sysfs_delete_device_group Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 063/101] s390/stack: fix possible register corruption with stack switch helper Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 064/101] KVM: do not allow mapping valid but non-reference-counted pages Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 065/101] i2c: robotfuzz-osif: fix control-request directions Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 066/101] ceph: must hold snap_rwsem when filling inode for async create Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 067/101] kthread_worker: split code for canceling the delayed work timer Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 068/101] kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 069/101] x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 070/101] x86/fpu: Make init_fpstate correct with optimized XSAVE Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 071/101] mm: add VM_WARN_ON_ONCE_PAGE() macro Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 072/101] mm/rmap: remove unneeded semicolon in page_not_mapped() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 073/101] mm/rmap: use page_not_mapped in try_to_unmap() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 074/101] mm, thp: use head page in __migration_entry_wait() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 075/101] mm/thp: fix __split_huge_pmd_locked() on shmem migration entry Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 076/101] mm/thp: make is_huge_zero_pmd() safe and quicker Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 077/101] mm/thp: try_to_unmap() use TTU_SYNC for safe splitting Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 078/101] mm/thp: fix vma_address() if virtual address below file offset Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 079/101] mm/thp: fix page_address_in_vma() on file THP tails Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 080/101] mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 081/101] mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 082/101] mm: page_vma_mapped_walk(): use page for pvmw->page Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 083/101] mm: page_vma_mapped_walk(): settle PageHuge on entry Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 084/101] mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 085/101] mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 086/101] mm: page_vma_mapped_walk(): crossing page table boundary Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 087/101] mm: page_vma_mapped_walk(): add a level of indentation Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 088/101] mm: page_vma_mapped_walk(): use goto instead of while (1) Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 089/101] mm: page_vma_mapped_walk(): get vma_address_end() earlier Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 090/101] mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 091/101] mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 092/101] mm, futex: fix shared futex pgoff on shmem huge page Sasha Levin
2021-06-28 14:25 ` [PATCH 5.10 093/101] KVM: SVM: Call SEV Guest Decommission if ASID binding fails Sasha Levin
2021-06-28 14:26 ` Sasha Levin [this message]
2021-06-28 14:26 ` [PATCH 5.10 095/101] netfs: fix test for whether we can skip read when writing beyond EOF Sasha Levin
2021-06-28 14:26 ` [PATCH 5.10 096/101] Revert "drm: add a locked version of drm_is_current_master" Sasha Levin
2021-06-28 14:26 ` [PATCH 5.10 097/101] certs: Add EFI_CERT_X509_GUID support for dbx entries Sasha Levin
2021-06-28 14:26 ` [PATCH 5.10 098/101] certs: Move load_system_certificate_list to a common function Sasha Levin
2021-06-28 14:26 ` [PATCH 5.10 099/101] certs: Add ability to preload revocation certs Sasha Levin
2021-06-28 14:26 ` [PATCH 5.10 100/101] integrity: Load mokx variables into the blacklist keyring Sasha Levin
2021-06-28 14:26 ` [PATCH 5.10 101/101] Linux 5.10.47-rc1 Sasha Levin
2021-06-28 20:49 ` [PATCH 5.10 000/101] 5.10.47-rc1 review Fox Chen
2021-06-29  7:29 ` Naresh Kamboju
2021-06-29 12:08 ` Sudip Mukherjee
2021-06-30 13:04   ` Sasha Levin
2021-06-29 18:20 ` Guenter Roeck
2021-06-30  1:01 ` Samuel Zou
2021-06-30 13:05   ` Sasha Levin
2021-07-01 11:55 ` Pavel Machek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210628142607.32218-95-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=bumyong.lee@samsung.com \
    --cc=chanho61.park@samsung.com \
    --cc=dominique.martinet@atmark-techno.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=hch@lst.de \
    --cc=horia.geanta@nxp.com \
    --cc=konrad.wilk@oracle.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox