mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2025-01-08 06:44:35 +08:00
29a90b7089
The intel-iommu DMA ops fail to correctly handle scatterlists where
sg->offset is greater than PAGE_SIZE - the IOVA allocation is computed
appropriately based on the page-aligned portion of the offset, but the
mapping is set up relative to sg->page, which means it fails to actually
cover the whole buffer (and in the worst case doesn't cover it at all):
(sg->dma_address + sg->dma_len) ----+
sg->dma_address ---------+ |
iov_pfn------+ | |
| | |
v v v
iova: a b c d e f
|--------|--------|--------|--------|--------|
<...calculated....>
[_____mapped______]
pfn: 0 1 2 3 4 5
|--------|--------|--------|--------|--------|
^ ^ ^
| | |
sg->page ----+ | |
sg->offset --------------+ |
(sg->offset + sg->length) ----------+
As a result, the caller ends up overrunning the mapping into whatever
lies beyond, which usually goes badly:
[ 429.645492] DMAR: DRHD: handling fault status reg 2
[ 429.650847] DMAR: [DMA Write] Request device [02:00.4] fault addr f2682000 ...
Whilst this is a fairly rare occurrence, it can happen from the result
of intermediate scatterlist processing such as scatterwalk_ffwd() in the
crypto layer. Whilst that particular site could be fixed up, it still
seems worthwhile to bring intel-iommu in line with other DMA API
implementations in handling this robustly.
To that end, fix the intel_map_sg() path to line up the mapping
correctly (in units of MM pages rather than VT-d pages to match the
aligned_nrpages() calculation) regardless of the offset, and use
sg_phys() consistently for clarity.
Reported-by: Harsh Jain <Harsh@chelsio.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed by: Ashok Raj <ashok.raj@intel.com>
Tested by: Jacob Pan <jacob.jun.pan@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
|
||
|---|---|---|
| .. | ||
| amd_iommu_init.c | ||
| amd_iommu_proto.h | ||
| amd_iommu_types.h | ||
| amd_iommu_v2.c | ||
| amd_iommu.c | ||
| arm-smmu-regs.h | ||
| arm-smmu-v3.c | ||
| arm-smmu.c | ||
| dma-iommu.c | ||
| dmar.c | ||
| exynos-iommu.c | ||
| fsl_pamu_domain.c | ||
| fsl_pamu_domain.h | ||
| fsl_pamu.c | ||
| fsl_pamu.h | ||
| intel_irq_remapping.c | ||
| intel-iommu.c | ||
| intel-svm.c | ||
| io-pgtable-arm-v7s.c | ||
| io-pgtable-arm.c | ||
| io-pgtable.c | ||
| io-pgtable.h | ||
| iommu-sysfs.c | ||
| iommu-traces.c | ||
| iommu.c | ||
| iova.c | ||
| ipmmu-vmsa.c | ||
| irq_remapping.c | ||
| irq_remapping.h | ||
| Kconfig | ||
| Makefile | ||
| msm_iommu_hw-8xxx.h | ||
| msm_iommu.c | ||
| msm_iommu.h | ||
| mtk_iommu_v1.c | ||
| mtk_iommu.c | ||
| mtk_iommu.h | ||
| of_iommu.c | ||
| omap-iommu-debug.c | ||
| omap-iommu.c | ||
| omap-iommu.h | ||
| omap-iopgtable.h | ||
| qcom_iommu.c | ||
| rockchip-iommu.c | ||
| s390-iommu.c | ||
| tegra-gart.c | ||
| tegra-smmu.c | ||