mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
swiotlb: skip swiotlb_bounce when orig_addr is zero
After patchddbd89deb7
("swiotlb: fix info leak with DMA_FROM_DEVICE"), swiotlb_bounce will be called in swiotlb_tbl_map_single unconditionally. This requires that the physical address must be valid, which is not always true on stable-4.19 or earlier version. On stable-4.19, swiotlb_alloc_buffer will call swiotlb_tbl_map_single with orig_addr equal to zero, which cause such a panic: Unable to handle kernel paging request at virtual address ffffb77a40000000 ... pc : __memcpy+0x100/0x180 lr : swiotlb_bounce+0x74/0x88 ... Call trace: __memcpy+0x100/0x180 swiotlb_tbl_map_single+0x2c8/0x338 swiotlb_alloc+0xb4/0x198 __dma_alloc+0x84/0x1d8 ... On stable-4.9 and stable-4.14, swiotlb_alloc_coherent wille call map_single with orig_addr equal to zero, which can cause same panic. Fix this by skipping swiotlb_bounce when orig_addr is zero. Fixes:ddbd89deb7
("swiotlb: fix info leak with DMA_FROM_DEVICE") Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
6af88cc6e4
commit
87fe5447ea
1 changed files with 2 additions and 1 deletions
|
@ -607,7 +607,8 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev,
|
|||
* unconditional bounce may prevent leaking swiotlb content (i.e.
|
||||
* kernel memory) to user-space.
|
||||
*/
|
||||
swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
|
||||
if (orig_addr)
|
||||
swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
|
||||
return tlb_addr;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(swiotlb_tbl_map_single);
|
||||
|
|
Loading…
Reference in a new issue