| From 5999d2ebdaeebb9a6aaffeda2a0efb11c485021d Mon Sep 17 00:00:00 2001 |
| From: Kees Cook <keescook@chromium.org> |
| Date: Tue, 29 Oct 2019 14:34:22 -0700 |
| Subject: [PATCH] dma-mapping: Add vmap checks to dma_map_single() |
| |
| commit 4544b9f25e70eae9f70a243de0cc802aa5c8cb69 upstream. |
| |
| As we've seen from USB and other areas[1], we need to always do runtime |
| checks for DMA operating on memory regions that might be remapped. This |
| adds vmap checks (similar to those already in USB but missing in other |
| places) into dma_map_single() so all callers benefit from the checking. |
| |
| [1] https://git.kernel.org/linus/3840c5b78803b2b6cc1ff820100a74a092c40cbb |
| |
| Suggested-by: Laura Abbott <labbott@redhat.com> |
| Signed-off-by: Kees Cook <keescook@chromium.org> |
| [hch: fixed the printk message] |
| Signed-off-by: Christoph Hellwig <hch@lst.de> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h |
| index 6309a721394b..e42c4620ef32 100644 |
| --- a/include/linux/dma-mapping.h |
| +++ b/include/linux/dma-mapping.h |
| @@ -577,6 +577,10 @@ static inline size_t dma_max_mapping_size(struct device *dev) |
| static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr, |
| size_t size, enum dma_data_direction dir, unsigned long attrs) |
| { |
| + /* DMA must never operate on areas that might be remapped. */ |
| + if (dev_WARN_ONCE(dev, is_vmalloc_addr(ptr), |
| + "rejecting DMA map of vmalloc memory\n")) |
| + return DMA_MAPPING_ERROR; |
| debug_dma_map_single(dev, ptr, size); |
| return dma_map_page_attrs(dev, virt_to_page(ptr), offset_in_page(ptr), |
| size, dir, attrs); |
| -- |
| 2.7.4 |
| |
