mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
To: Tianyu Lan <Tianyu.Lan@microsoft.com>,
	Michael Kelley <mikelley@microsoft.com>,
	Christoph Hellwig <hch@lst.de>,
	Marek Szyprowski <m.szyprowski@samsung.com>,
	Robin Murphy <robin.murphy@arm.com>,
	iommu@lists.linux.dev, linux-kernel@vger.kernel.org
Cc: Brian Johannesmeyer <bjohannesmeyer@gmail.com>,
	Raphael Isemann <teemperor@gmail.com>,
	Cristiano Giuffrida <giuffrida@cs.vu.nl>,
	Herbert Bos <h.j.bos@vu.nl>, Greg KH <gregkh@linuxfoundation.org>
Subject: [RFC 1/1] swiotlb: Replace BUG_ON() with graceful error handling
Date: Fri, 22 Nov 2024 20:13:04 +0100	[thread overview]
Message-ID: <20241122191304.4182642-2-bjohannesmeyer@gmail.com> (raw)
In-Reply-To: <20241122191304.4182642-1-bjohannesmeyer@gmail.com>

Replace the BUG_ON() assertion in swiotlb_release_slots() with a
conditional check and return. This change prevents a corrupted tlb_addr
from causing a kernel panic.

Co-developed-by: Raphael Isemann <teemperor@gmail.com>
Signed-off-by: Raphael Isemann <teemperor@gmail.com>
Signed-off-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
---
 kernel/dma/swiotlb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index aa0a4a220719..54b4f9665772 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -834,7 +834,11 @@ static void swiotlb_release_slots(struct device *dev, phys_addr_t tlb_addr)
 	 * While returning the entries to the free list, we merge the entries
 	 * with slots below and above the pool being returned.
 	 */
-	BUG_ON(aindex >= mem->nareas);
+	if (unlikely(aindex >= mem->nareas)) {
+		dev_err(dev, "%s: invalid area index (%d >= %d)\n", __func__,
+			aindex, mem->nareas);
+		return;
+	}
 
 	spin_lock_irqsave(&area->lock, flags);
 	if (index + nslots < ALIGN(index + 1, IO_TLB_SEGSIZE))
-- 
2.34.1


  reply	other threads:[~2024-11-22 19:13 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-11-22 19:13 [RFC 0/1] swiotlb: Mitigate potential DoS caused by BUG_ON() Brian Johannesmeyer
2024-11-22 19:13 ` Brian Johannesmeyer [this message]
2024-11-22 20:34   ` [RFC 1/1] swiotlb: Replace BUG_ON() with graceful error handling Brian Johannesmeyer
2024-11-25  7:59   ` Christoph Hellwig
2024-11-25 15:03   ` Robin Murphy
2024-12-06 20:36     ` Brian Johannesmeyer
2024-11-22 20:33 ` [RFC 0/1] swiotlb: Mitigate potential DoS caused by BUG_ON() Brian Johannesmeyer
2024-11-25 13:48   ` Robin Murphy
2024-11-25  8:14 ` Christoph Hellwig

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241122191304.4182642-2-bjohannesmeyer@gmail.com \
    --to=bjohannesmeyer@gmail.com \
    --cc=Tianyu.Lan@microsoft.com \
    --cc=giuffrida@cs.vu.nl \
    --cc=gregkh@linuxfoundation.org \
    --cc=h.j.bos@vu.nl \
    --cc=hch@lst.de \
    --cc=iommu@lists.linux.dev \
    --cc=linux-kernel@vger.kernel.org \
    --cc=m.szyprowski@samsung.com \
    --cc=mikelley@microsoft.com \
    --cc=robin.murphy@arm.com \
    --cc=teemperor@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®