Skip to content

Commit

Permalink
dma-debug: fix physical address calculation for struct dma_debug_entry
Browse files Browse the repository at this point in the history
Offset into the page should also be considered while calculating a physical
address for struct dma_debug_entry. page_to_phys() just shifts the value
PAGE_SHIFT bits to the left so offset part is zero-filled.

An example (wrong) debug assertion failure with CONFIG_DMA_API_DEBUG
enabled which is observed during systemd boot process after recent
dma-debug changes:

DMA-API: e1000 0000:00:03.0: cacheline tracking EEXIST, overlapping mappings aren't supported
WARNING: CPU: 4 PID: 941 at kernel/dma/debug.c:596 add_dma_entry
CPU: 4 UID: 0 PID: 941 Comm: ip Not tainted 6.12.0+ #288
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:add_dma_entry kernel/dma/debug.c:596
Call Trace:
 <TASK>
debug_dma_map_page kernel/dma/debug.c:1236
dma_map_page_attrs kernel/dma/mapping.c:179
e1000_alloc_rx_buffers drivers/net/ethernet/intel/e1000/e1000_main.c:4616
...

Found by Linux Verification Center (linuxtesting.org).

Fixes: 9d4f645 ("dma-debug: store a phys_addr_t in struct dma_debug_entry")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
[hch: added a little helper to clean up the code]
Signed-off-by: Christoph Hellwig <hch@lst.de>
  • Loading branch information
Fedor Pchelkin authored and Christoph Hellwig committed Nov 28, 2024
1 parent 22293c3 commit aef7ee7
Showing 1 changed file with 15 additions and 5 deletions.
20 changes: 15 additions & 5 deletions kernel/dma/debug.c
Original file line number Diff line number Diff line change
Expand Up @@ -1219,7 +1219,7 @@ void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,

entry->dev = dev;
entry->type = dma_debug_single;
entry->paddr = page_to_phys(page);
entry->paddr = page_to_phys(page) + offset;
entry->dev_addr = dma_addr;
entry->size = size;
entry->direction = direction;
Expand Down Expand Up @@ -1377,6 +1377,18 @@ void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
}
}

static phys_addr_t virt_to_paddr(void *virt)
{
struct page *page;

if (is_vmalloc_addr(virt))
page = vmalloc_to_page(virt);
else
page = virt_to_page(virt);

return page_to_phys(page) + offset_in_page(virt);
}

void debug_dma_alloc_coherent(struct device *dev, size_t size,
dma_addr_t dma_addr, void *virt,
unsigned long attrs)
Expand All @@ -1399,8 +1411,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,

entry->type = dma_debug_coherent;
entry->dev = dev;
entry->paddr = page_to_phys((is_vmalloc_addr(virt) ?
vmalloc_to_page(virt) : virt_to_page(virt)));
entry->paddr = virt_to_paddr(virt);
entry->size = size;
entry->dev_addr = dma_addr;
entry->direction = DMA_BIDIRECTIONAL;
Expand All @@ -1423,8 +1434,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
return;

ref.paddr = page_to_phys((is_vmalloc_addr(virt) ?
vmalloc_to_page(virt) : virt_to_page(virt)));
ref.paddr = virt_to_paddr(virt);

if (unlikely(dma_debug_disabled()))
return;
Expand Down

0 comments on commit aef7ee7

Please sign in to comment.