| Message ID | 20220706203353.247633-1-f.fainelli@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v3] ARM: Fix MAX_DMA_ADDRESS overflow | expand |
On 7/6/22 13:33, Florian Fainelli wrote: > Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") > added a check to determine whether arm_dma_zone_size is exceeding the > amount of kernel virtual address space available between the upper 4GB > virtual address limit and PAGE_OFFSET in order to provide a suitable > definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual > address space. The quantity used for comparison was off by a missing > trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit > quantity. > > This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform > where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value > of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being > 0x1_0000_0000 which overflows the unsigned long type used throughout > __pa() and then __virt_addr_valid(). Because the virtual address passed > to __virt_addr_valid() would now be 0, the function would loudly warn > and flood the kernel log, thus making the platform unable to boot > properly. > > Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") > Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Shall I send this to RMK's patch system?
On Thu, Jul 14, 2022 at 1:28 AM Florian Fainelli <f.fainelli@gmail.com> wrote: > On 7/6/22 13:33, Florian Fainelli wrote: > > Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") > > added a check to determine whether arm_dma_zone_size is exceeding the > > amount of kernel virtual address space available between the upper 4GB > > virtual address limit and PAGE_OFFSET in order to provide a suitable > > definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual > > address space. The quantity used for comparison was off by a missing > > trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit > > quantity. > > > > This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform > > where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value > > of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being > > 0x1_0000_0000 which overflows the unsigned long type used throughout > > __pa() and then __virt_addr_valid(). Because the virtual address passed > > to __virt_addr_valid() would now be 0, the function would loudly warn > > and flood the kernel log, thus making the platform unable to boot > > properly. > > > > Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") > > Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> > > Shall I send this to RMK's patch system? I think so! Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Yours, Linus Walleij
On 7/18/2022 5:53 AM, Linus Walleij wrote: > On Thu, Jul 14, 2022 at 1:28 AM Florian Fainelli <f.fainelli@gmail.com> wrote: >> On 7/6/22 13:33, Florian Fainelli wrote: >>> Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") >>> added a check to determine whether arm_dma_zone_size is exceeding the >>> amount of kernel virtual address space available between the upper 4GB >>> virtual address limit and PAGE_OFFSET in order to provide a suitable >>> definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual >>> address space. The quantity used for comparison was off by a missing >>> trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit >>> quantity. >>> >>> This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform >>> where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value >>> of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being >>> 0x1_0000_0000 which overflows the unsigned long type used throughout >>> __pa() and then __virt_addr_valid(). Because the virtual address passed >>> to __virt_addr_valid() would now be 0, the function would loudly warn >>> and flood the kernel log, thus making the platform unable to boot >>> properly. >>> >>> Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") >>> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> >> >> Shall I send this to RMK's patch system? > > I think so! > Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Thanks: https://www.armlinux.org.uk/developer/patches/viewpatch.php?id=9216/1
diff --git a/arch/arm/include/asm/dma.h b/arch/arm/include/asm/dma.h index a81dda65c576..45180a2cc47c 100644 --- a/arch/arm/include/asm/dma.h +++ b/arch/arm/include/asm/dma.h @@ -10,7 +10,7 @@ #else #define MAX_DMA_ADDRESS ({ \ extern phys_addr_t arm_dma_zone_size; \ - arm_dma_zone_size && arm_dma_zone_size < (0x10000000 - PAGE_OFFSET) ? \ + arm_dma_zone_size && arm_dma_zone_size < (0x100000000ULL - PAGE_OFFSET) ? \ (PAGE_OFFSET + arm_dma_zone_size) : 0xffffffffUL; }) #endif
Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") added a check to determine whether arm_dma_zone_size is exceeding the amount of kernel virtual address space available between the upper 4GB virtual address limit and PAGE_OFFSET in order to provide a suitable definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual address space. The quantity used for comparison was off by a missing trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit quantity. This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being 0x1_0000_0000 which overflows the unsigned long type used throughout __pa() and then __virt_addr_valid(). Because the virtual address passed to __virt_addr_valid() would now be 0, the function would loudly warn and flood the kernel log, thus making the platform unable to boot properly. Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> --- Changes in v3: - added ULL suffix to the constant - reworded the commit message to be clearer Changes in v2: - simplify the patch and drop the first patch that attempted to fix an off by one in the calculation. arch/arm/include/asm/dma.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)