[PATCH v2] swiotlb: avoid potential left shift overflow

[PATCH v2] swiotlb: avoid potential left shift overflow

[Chao Gao]

The second operand passed to slot_addr() is declared as int or unsigned int
in all call sites. The left-shift to get the offset of a slot can overflow
if swiotlb size is larger than 4G.

Convert the macro to an inline function and declare the second argument as
phys_addr_t to avoid the potential overflow.

Fixes: 26a7e094783d ("swiotlb: refactor swiotlb_tbl_map_single")
Signed-off-by: Chao Gao <chao.gao@intel.com>
---
 kernel/dma/swiotlb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index c5a9190b218f..41ea9fb3efe1 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -579,7 +579,10 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t size
 	}
 }
 
-#define slot_addr(start, idx)	((start) + ((idx) << IO_TLB_SHIFT))
+static inline phys_addr_t slot_addr(phys_addr_t start, phys_addr_t idx)
+{
+	return start + (idx << IO_TLB_SHIFT);
+}
 
 /*
  * Carefully handle integer overflow which can occur when boundary_mask == ~0UL.

base-commit: 5c850d31880e00f063fa2a3746ba212c4bcc510f
-- 
2.25.1

Re: [PATCH v2] swiotlb: avoid potential left shift overflow

[Dongli Zhang]

I also encountered this when sending out another version of the 64-bit swiotlb.

https://lore.kernel.org/all/20220609005553.30954-8-dongli.zhang@oracle.com/

Unfortunately, I could not find an environment (e.g., powerpc) to allocate more
than 4G until swiotlb supports 64-bit.

Although xen supports 64-bit, but the hypervisor side limits the max to < 4G.

Dongli Zhang

On 8/19/22 1:45 AM, Chao Gao wrote:
> The second operand passed to slot_addr() is declared as int or unsigned int
> in all call sites. The left-shift to get the offset of a slot can overflow
> if swiotlb size is larger than 4G.
> 
> Convert the macro to an inline function and declare the second argument as
> phys_addr_t to avoid the potential overflow.
> 
> Fixes: 26a7e094783d ("swiotlb: refactor swiotlb_tbl_map_single")
> Signed-off-by: Chao Gao <chao.gao@intel.com>
> ---
>  kernel/dma/swiotlb.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
> index c5a9190b218f..41ea9fb3efe1 100644
> --- a/kernel/dma/swiotlb.c
> +++ b/kernel/dma/swiotlb.c
> @@ -579,7 +579,10 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t size
>  	}
>  }
>  
> -#define slot_addr(start, idx)	((start) + ((idx) << IO_TLB_SHIFT))
> +static inline phys_addr_t slot_addr(phys_addr_t start, phys_addr_t idx)
> +{
> +	return start + (idx << IO_TLB_SHIFT);
> +}
>  
>  /*
>   * Carefully handle integer overflow which can occur when boundary_mask == ~0UL.
> 
> base-commit: 5c850d31880e00f063fa2a3746ba212c4bcc510f
> 

Re: [PATCH v2] swiotlb: avoid potential left shift overflow

[Chao Gao]

On Fri, Aug 19, 2022 at 06:44:05AM -0700, Dongli Zhang wrote:
>I also encountered this when sending out another version of the 64-bit swiotlb.
>
>https://lore.kernel.org/all/20220609005553.30954-8-dongli.zhang@oracle.com/
>
>Unfortunately, I could not find an environment (e.g., powerpc) to allocate more
>than 4G until swiotlb supports 64-bit.
>
>Although xen supports 64-bit, but the hypervisor side limits the max to < 4G.

Sorry. I didn't notice your series before. I agree that the overflow
isn't an issue if swiotlb size cannot be larger than 4GB. That's why
I said the overflow is a potential issue.

In an internal effort to measure the impact of swiotlb size to IO
performance of confidential VM (e.g., TDX VM), we simply added
SWIOTLB_ANY to the default io_tlb_mem to lift the restriction on swiotlb
size. Then we hit this issue and worked out this fix. I posted this
fix because I think the fix by itself is helpful because it removes the
implicit dependency of the left-shift in slot_addr() on swiotlb size and
then someone trying to lift the size limitation won't hit the same issue.

Re: [PATCH v2] swiotlb: avoid potential left shift overflow

[Dongli Zhang]

On 8/19/22 6:42 PM, Chao Gao wrote:
> On Fri, Aug 19, 2022 at 06:44:05AM -0700, Dongli Zhang wrote:
>> I also encountered this when sending out another version of the 64-bit swiotlb.
>>
>> https://urldefense.com/v3/__https://lore.kernel.org/all/20220609005553.30954-8-dongli.zhang@oracle.com/__;!!ACWV5N9M2RV99hQ!O-2m8d_6yG-OJx1eoiF-wmpJy13HaSz884huJjbeRA9tUdXnUbWsD34MAoY21pSYMdS8tKOM0_7teFvOa3w$  
>>
>> Unfortunately, I could not find an environment (e.g., powerpc) to allocate more
>> than 4G until swiotlb supports 64-bit.
>>
>> Although xen supports 64-bit, but the hypervisor side limits the max to < 4G.
> 
> Sorry. I didn't notice your series before. I agree that the overflow
> isn't an issue if swiotlb size cannot be larger than 4GB. That's why
> I said the overflow is a potential issue.
> 
> In an internal effort to measure the impact of swiotlb size to IO
> performance of confidential VM (e.g., TDX VM), we simply added
> SWIOTLB_ANY to the default io_tlb_mem to lift the restriction on swiotlb
> size. Then we hit this issue and worked out this fix. I posted this
> fix because I think the fix by itself is helpful because it removes the
> implicit dependency of the left-shift in slot_addr() on swiotlb size and
> then someone trying to lift the size limitation won't hit the same issue.
> 

Thank you very much for the explanation! I was just curious how to test this
without code modification or powerpc hardware.

Although my RB may not count much:

Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>

Dongli Zhang

Re: [PATCH v2] swiotlb: avoid potential left shift overflow

[Christoph Hellwig]

On Sat, Aug 20, 2022 at 09:42:38AM +0800, Chao Gao wrote:
> In an internal effort to measure the impact of swiotlb size to IO
> performance of confidential VM (e.g., TDX VM), we simply added
> SWIOTLB_ANY to the default io_tlb_mem to lift the restriction on swiotlb
> size. Then we hit this issue and worked out this fix. I posted this
> fix because I think the fix by itself is helpful because it removes the
> implicit dependency of the left-shift in slot_addr() on swiotlb size and
> then someone trying to lift the size limitation won't hit the same issue.

SWIOTLB_ANY is used for real, so I think this is a legitimate fix.
I'll apply it.

Re: [PATCH v2] swiotlb: avoid potential left shift overflow

[Christoph Hellwig]

Thanks, applied.