Re: [PATCH V2] dma-direct: Fix potential NULL pointer dereference
On 2020-09-17 12:05 p.m., Konrad Rzeszutek Wilk wrote: On Wed, Sep 16, 2020 at 02:51:06PM -0600, Thomas Tai wrote: When booting the kernel v5.9-rc4 on a VM, the kernel would panic when printing a warning message in swiotlb_map(). The dev->dma_mask must not be a NULL pointer when calling the dma mapping layer. A NULL pointer check can potentially avoid the panic. [drm] Initialized virtio_gpu 0.1.0 0 for virtio0 on minor 0 BUG: kernel NULL pointer dereference, address: #PF: supervisor read access in kernel mode #PF: error_code(0x) - not-present page PGD 0 P4D 0 Oops: [#1] SMP PTI CPU: 1 PID: 331 Comm: systemd-udevd Not tainted 5.9.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:swiotlb_map+0x1ac/0x200 Code: e8 d9 fc ff ff 80 3d 92 ee 4c 01 00 75 51 49 8b 84 24 48 02 00 00 4d 8b 6c 24 50 c6 05 7c ee 4c 01 01 4d 8b bc 24 58 02 00 00 <4c> 8b 30 4d 85 ed 75 04 4d 8b 2c 24 4c 89 e7 e8 10 6b 4f 00 4d 89 RSP: 0018:9f96801af6f8 EFLAGS: 00010246 RAX: RBX: 1000 RCX: 0080 RDX: 007f RSI: 0202 RDI: 0202 RBP: 9f96801af748 R08: R09: 0020 R10: R11: 8fabfffa3000 R12: 8faad02c7810 R13: R14: 0020 R15: FS: 7fabc63588c0() GS:8fabf7c8() knlGS: CS: 0010 DS: ES: CR0: 80050033 CR2: CR3: 000151496005 CR4: 00370ee0 DR0: DR1: DR2: DR3: DR6: fffe0ff0 DR7: 0400 Call Trace: dma_direct_map_sg+0x124/0x210 dma_map_sg_attrs+0x32/0x50 drm_gem_shmem_get_pages_sgt+0x6a/0x90 [drm] virtio_gpu_object_create+0x140/0x2f0 [virtio_gpu] ? ww_mutex_unlock+0x26/0x30 virtio_gpu_mode_dumb_create+0xab/0x160 [virtio_gpu] drm_mode_create_dumb+0x82/0x90 [drm] drm_client_framebuffer_create+0xaa/0x200 [drm] drm_fb_helper_generic_probe+0x59/0x150 [drm_kms_helper] drm_fb_helper_single_fb_probe+0x29e/0x3e0 [drm_kms_helper] __drm_fb_helper_initial_config_and_unlock+0x41/0xd0 [drm_kms_helper] drm_fbdev_client_hotplug+0xe6/0x1a0 [drm_kms_helper] drm_fbdev_generic_setup+0xaf/0x170 [drm_kms_helper] virtio_gpu_probe+0xea/0x100 [virtio_gpu] virtio_dev_probe+0x14b/0x1e0 [virtio] really_probe+0x1db/0x440 driver_probe_device+0xe9/0x160 device_driver_attach+0x5d/0x70 __driver_attach+0x8f/0x150 ? device_driver_attach+0x70/0x70 bus_for_each_dev+0x7e/0xc0 driver_attach+0x1e/0x20 bus_add_driver+0x152/0x1f0 driver_register+0x74/0xd0 ? 0xc0529000 register_virtio_driver+0x20/0x30 [virtio] virtio_gpu_driver_init+0x15/0x1000 [virtio_gpu] do_one_initcall+0x4a/0x1fa ? _cond_resched+0x19/0x30 ? kmem_cache_alloc_trace+0x16b/0x2e0 do_init_module+0x62/0x240 load_module+0xe0e/0x1100 ? security_kernel_post_read_file+0x5c/0x70 __do_sys_finit_module+0xbe/0x120 ? __do_sys_finit_module+0xbe/0x120 __x64_sys_finit_module+0x1a/0x20 do_syscall_64+0x38/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Signed-off-by: Thomas Tai Reviewed-by: Konrad Rzeszutek Wilk Thank you, Konrad for reviewing the fix. Thomas Thank you! --- include/linux/dma-direct.h | 3 --- kernel/dma/mapping.c | 11 +++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h index 6e87225..0648708 100644 --- a/include/linux/dma-direct.h +++ b/include/linux/dma-direct.h @@ -62,9 +62,6 @@ static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size, { dma_addr_t end = addr + size - 1; - if (!dev->dma_mask) - return false; - if (is_ram && !IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && min(addr, end) < phys_to_dma(dev, PFN_PHYS(min_low_pfn))) return false; diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c index 0d12942..7133d5c 100644 --- a/kernel/dma/mapping.c +++ b/kernel/dma/mapping.c @@ -144,6 +144,10 @@ dma_addr_t dma_map_page_attrs(struct device *dev, struct page *page, dma_addr_t addr; BUG_ON(!valid_dma_direction(dir)); + + if (WARN_ON_ONCE(!dev->dma_mask)) + return DMA_MAPPING_ERROR; + if (dma_map_direct(dev, ops)) addr = dma_direct_map_page(dev, page, offset, size, dir, attrs); else @@ -179,6 +183,10 @@ int dma_map_sg_attrs(struct device *dev, struct scatterlist *sg, int nents, int ents; BUG_ON(!valid_dma_direction(dir)); + + if (WARN_ON_ONCE(!dev->dma_mask)) + return 0; + if (dma_map_direct(dev, ops)) ents = dma_direct_map_sg(dev, sg, nents, dir, attrs); else @@ -213,6 +221,9 @@ dma_addr_t dma_map_resource(struc
Re: [PATCH V2] dma-direct: Fix potential NULL pointer dereference
On 2020-09-17 12:44 p.m., Christoph Hellwig wrote: Thanks, applied to the dma-mapping for-next tree. Thank you, Christoph for suggesting and applying the fix. Thomas ___ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
Re: [PATCH V2] dma-direct: Fix potential NULL pointer dereference
Thanks, applied to the dma-mapping for-next tree. ___ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
Re: [PATCH V2] dma-direct: Fix potential NULL pointer dereference
On Wed, Sep 16, 2020 at 02:51:06PM -0600, Thomas Tai wrote: > When booting the kernel v5.9-rc4 on a VM, the kernel would panic when > printing a warning message in swiotlb_map(). The dev->dma_mask must not > be a NULL pointer when calling the dma mapping layer. A NULL pointer check > can potentially avoid the panic. > > [drm] Initialized virtio_gpu 0.1.0 0 for virtio0 on minor 0 > BUG: kernel NULL pointer dereference, address: > #PF: supervisor read access in kernel mode > #PF: error_code(0x) - not-present page > PGD 0 P4D 0 > Oops: [#1] SMP PTI > CPU: 1 PID: 331 Comm: systemd-udevd Not tainted 5.9.0-rc4 #1 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), > BIOS 1.13.0-1ubuntu1 04/01/2014 > RIP: 0010:swiotlb_map+0x1ac/0x200 > Code: e8 d9 fc ff ff 80 3d 92 ee 4c 01 00 75 51 49 8b 84 24 48 02 00 00 > 4d 8b 6c 24 50 c6 05 7c ee 4c 01 01 4d 8b bc 24 58 02 00 00 <4c> 8b 30 > 4d 85 ed 75 04 4d 8b 2c 24 4c 89 e7 e8 10 6b 4f 00 4d 89 > RSP: 0018:9f96801af6f8 EFLAGS: 00010246 > RAX: RBX: 1000 RCX: 0080 > RDX: 007f RSI: 0202 RDI: 0202 > RBP: 9f96801af748 R08: R09: 0020 > R10: R11: 8fabfffa3000 R12: 8faad02c7810 > R13: R14: 0020 R15: > FS: 7fabc63588c0() GS:8fabf7c8() > knlGS: > CS: 0010 DS: ES: CR0: 80050033 > CR2: CR3: 000151496005 CR4: 00370ee0 > DR0: DR1: DR2: > DR3: DR6: fffe0ff0 DR7: 0400 > Call Trace: > dma_direct_map_sg+0x124/0x210 > dma_map_sg_attrs+0x32/0x50 > drm_gem_shmem_get_pages_sgt+0x6a/0x90 [drm] > virtio_gpu_object_create+0x140/0x2f0 [virtio_gpu] > ? ww_mutex_unlock+0x26/0x30 > virtio_gpu_mode_dumb_create+0xab/0x160 [virtio_gpu] > drm_mode_create_dumb+0x82/0x90 [drm] > drm_client_framebuffer_create+0xaa/0x200 [drm] > drm_fb_helper_generic_probe+0x59/0x150 [drm_kms_helper] > drm_fb_helper_single_fb_probe+0x29e/0x3e0 [drm_kms_helper] > __drm_fb_helper_initial_config_and_unlock+0x41/0xd0 [drm_kms_helper] > drm_fbdev_client_hotplug+0xe6/0x1a0 [drm_kms_helper] > drm_fbdev_generic_setup+0xaf/0x170 [drm_kms_helper] > virtio_gpu_probe+0xea/0x100 [virtio_gpu] > virtio_dev_probe+0x14b/0x1e0 [virtio] > really_probe+0x1db/0x440 > driver_probe_device+0xe9/0x160 > device_driver_attach+0x5d/0x70 > __driver_attach+0x8f/0x150 > ? device_driver_attach+0x70/0x70 > bus_for_each_dev+0x7e/0xc0 > driver_attach+0x1e/0x20 > bus_add_driver+0x152/0x1f0 > driver_register+0x74/0xd0 > ? 0xc0529000 > register_virtio_driver+0x20/0x30 [virtio] > virtio_gpu_driver_init+0x15/0x1000 [virtio_gpu] > do_one_initcall+0x4a/0x1fa > ? _cond_resched+0x19/0x30 > ? kmem_cache_alloc_trace+0x16b/0x2e0 > do_init_module+0x62/0x240 > load_module+0xe0e/0x1100 > ? security_kernel_post_read_file+0x5c/0x70 > __do_sys_finit_module+0xbe/0x120 > ? __do_sys_finit_module+0xbe/0x120 > __x64_sys_finit_module+0x1a/0x20 > do_syscall_64+0x38/0x50 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > Signed-off-by: Thomas Tai Reviewed-by: Konrad Rzeszutek Wilk Thank you! > --- > include/linux/dma-direct.h | 3 --- > kernel/dma/mapping.c | 11 +++ > 2 files changed, 11 insertions(+), 3 deletions(-) > > diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h > index 6e87225..0648708 100644 > --- a/include/linux/dma-direct.h > +++ b/include/linux/dma-direct.h > @@ -62,9 +62,6 @@ static inline bool dma_capable(struct device *dev, > dma_addr_t addr, size_t size, > { > dma_addr_t end = addr + size - 1; > > - if (!dev->dma_mask) > - return false; > - > if (is_ram && !IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && > min(addr, end) < phys_to_dma(dev, PFN_PHYS(min_low_pfn))) > return false; > diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c > index 0d12942..7133d5c 100644 > --- a/kernel/dma/mapping.c > +++ b/kernel/dma/mapping.c > @@ -144,6 +144,10 @@ dma_addr_t dma_map_page_attrs(struct device *dev, struct > page *page, > dma_addr_t addr; > > BUG_ON(!valid_dma_direction(dir)); > + > + if (WARN_ON_ONCE(!dev->dma_mask)) > + return DMA_MAPPING_ERROR; > + > if (dma_map_direct(dev, ops)) > addr = dma_direct_map_page(dev, page, offset, size, dir, attrs); > else > @@ -179,6 +183,10 @@ int dma_map_sg_attrs(struct device *dev, struct > scatterlist *sg, int nents, > int ents; > > BUG_ON(!valid_dma_direction(dir)); > + > + if (WARN_ON_ONCE(!dev->dma_mask)) > + return 0; > + > if (dma_map_direct(dev, ops)) > ents = dma_direct_map_sg(dev, sg, nents, dir, attrs); > else > @@ -213,6 +221,9 @@ dma_ad
[PATCH V2] dma-direct: Fix potential NULL pointer dereference
When booting the kernel v5.9-rc4 on a VM, the kernel would panic when printing a warning message in swiotlb_map(). The dev->dma_mask must not be a NULL pointer when calling the dma mapping layer. A NULL pointer check can potentially avoid the panic. [drm] Initialized virtio_gpu 0.1.0 0 for virtio0 on minor 0 BUG: kernel NULL pointer dereference, address: #PF: supervisor read access in kernel mode #PF: error_code(0x) - not-present page PGD 0 P4D 0 Oops: [#1] SMP PTI CPU: 1 PID: 331 Comm: systemd-udevd Not tainted 5.9.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:swiotlb_map+0x1ac/0x200 Code: e8 d9 fc ff ff 80 3d 92 ee 4c 01 00 75 51 49 8b 84 24 48 02 00 00 4d 8b 6c 24 50 c6 05 7c ee 4c 01 01 4d 8b bc 24 58 02 00 00 <4c> 8b 30 4d 85 ed 75 04 4d 8b 2c 24 4c 89 e7 e8 10 6b 4f 00 4d 89 RSP: 0018:9f96801af6f8 EFLAGS: 00010246 RAX: RBX: 1000 RCX: 0080 RDX: 007f RSI: 0202 RDI: 0202 RBP: 9f96801af748 R08: R09: 0020 R10: R11: 8fabfffa3000 R12: 8faad02c7810 R13: R14: 0020 R15: FS: 7fabc63588c0() GS:8fabf7c8() knlGS: CS: 0010 DS: ES: CR0: 80050033 CR2: CR3: 000151496005 CR4: 00370ee0 DR0: DR1: DR2: DR3: DR6: fffe0ff0 DR7: 0400 Call Trace: dma_direct_map_sg+0x124/0x210 dma_map_sg_attrs+0x32/0x50 drm_gem_shmem_get_pages_sgt+0x6a/0x90 [drm] virtio_gpu_object_create+0x140/0x2f0 [virtio_gpu] ? ww_mutex_unlock+0x26/0x30 virtio_gpu_mode_dumb_create+0xab/0x160 [virtio_gpu] drm_mode_create_dumb+0x82/0x90 [drm] drm_client_framebuffer_create+0xaa/0x200 [drm] drm_fb_helper_generic_probe+0x59/0x150 [drm_kms_helper] drm_fb_helper_single_fb_probe+0x29e/0x3e0 [drm_kms_helper] __drm_fb_helper_initial_config_and_unlock+0x41/0xd0 [drm_kms_helper] drm_fbdev_client_hotplug+0xe6/0x1a0 [drm_kms_helper] drm_fbdev_generic_setup+0xaf/0x170 [drm_kms_helper] virtio_gpu_probe+0xea/0x100 [virtio_gpu] virtio_dev_probe+0x14b/0x1e0 [virtio] really_probe+0x1db/0x440 driver_probe_device+0xe9/0x160 device_driver_attach+0x5d/0x70 __driver_attach+0x8f/0x150 ? device_driver_attach+0x70/0x70 bus_for_each_dev+0x7e/0xc0 driver_attach+0x1e/0x20 bus_add_driver+0x152/0x1f0 driver_register+0x74/0xd0 ? 0xc0529000 register_virtio_driver+0x20/0x30 [virtio] virtio_gpu_driver_init+0x15/0x1000 [virtio_gpu] do_one_initcall+0x4a/0x1fa ? _cond_resched+0x19/0x30 ? kmem_cache_alloc_trace+0x16b/0x2e0 do_init_module+0x62/0x240 load_module+0xe0e/0x1100 ? security_kernel_post_read_file+0x5c/0x70 __do_sys_finit_module+0xbe/0x120 ? __do_sys_finit_module+0xbe/0x120 __x64_sys_finit_module+0x1a/0x20 do_syscall_64+0x38/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Signed-off-by: Thomas Tai --- include/linux/dma-direct.h | 3 --- kernel/dma/mapping.c | 11 +++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h index 6e87225..0648708 100644 --- a/include/linux/dma-direct.h +++ b/include/linux/dma-direct.h @@ -62,9 +62,6 @@ static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size, { dma_addr_t end = addr + size - 1; - if (!dev->dma_mask) - return false; - if (is_ram && !IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && min(addr, end) < phys_to_dma(dev, PFN_PHYS(min_low_pfn))) return false; diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c index 0d12942..7133d5c 100644 --- a/kernel/dma/mapping.c +++ b/kernel/dma/mapping.c @@ -144,6 +144,10 @@ dma_addr_t dma_map_page_attrs(struct device *dev, struct page *page, dma_addr_t addr; BUG_ON(!valid_dma_direction(dir)); + + if (WARN_ON_ONCE(!dev->dma_mask)) + return DMA_MAPPING_ERROR; + if (dma_map_direct(dev, ops)) addr = dma_direct_map_page(dev, page, offset, size, dir, attrs); else @@ -179,6 +183,10 @@ int dma_map_sg_attrs(struct device *dev, struct scatterlist *sg, int nents, int ents; BUG_ON(!valid_dma_direction(dir)); + + if (WARN_ON_ONCE(!dev->dma_mask)) + return 0; + if (dma_map_direct(dev, ops)) ents = dma_direct_map_sg(dev, sg, nents, dir, attrs); else @@ -213,6 +221,9 @@ dma_addr_t dma_map_resource(struct device *dev, phys_addr_t phys_addr, BUG_ON(!valid_dma_direction(dir)); + if (WARN_ON_ONCE(!dev->dma_mask)) + return DMA_MAPPING_ERROR; + /* Don't allow RAM to be mapped */ if (WARN_ON_ONCE(pfn_valid(PHYS_PFN(phys_addr