* [PATCH] dmaengine: ppc4xx: check dma_map_page() errors in probe
@ 2026-09-10 21:43 Rosen Penev
2026-09-11 16:05 ` Frank Li
0 siblings, 1 reply; 3+ messages in thread
From: Rosen Penev @ 2026-09-10 21:43 UTC (permalink / raw)
To: dmaengine
Cc: Vinod Koul, Frank Li, Anatolij Gustschin, Yuri Tikhonov,
Dan Williams, open list
In ppc440spe_adma_probe() the helper pages are mapped with
dma_map_page() but the returned DMA address is never validated with
dma_mapping_error(). On 440SPe the mapping goes through the
SWIOTLB/direct map, which can fail under memory pressure or with an
IOMMU, returning DMA_MAPPING_ERROR. The bogus address would then be
programmed into the CDBs used by the async validation and
mult/sum_product operations, causing the engine to DMA to or from
arbitrary memory and corrupt data.
Fail the probe when either mapping fails, freeing the pages and
unmapping the first page if the second mapping fails.
Fixes: 12458ea06efd7 ("ppc440spe-adma: adds updated ppc440spe adma driver")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/dma/ppc4xx/adma.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 279a431ccae3..89e778896d7a 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -4156,8 +4156,22 @@ static int ppc440spe_adma_probe(struct platform_device *ofdev)
}
chan->pdest = dma_map_page(&ofdev->dev, chan->pdest_page, 0,
PAGE_SIZE, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(&ofdev->dev, chan->pdest)) {
+ __free_page(chan->pdest_page);
+ __free_page(chan->qdest_page);
+ ret = -ENOMEM;
+ goto out;
+ }
chan->qdest = dma_map_page(&ofdev->dev, chan->qdest_page, 0,
PAGE_SIZE, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(&ofdev->dev, chan->qdest)) {
+ dma_unmap_page(&ofdev->dev, chan->pdest,
+ PAGE_SIZE, DMA_BIDIRECTIONAL);
+ __free_page(chan->pdest_page);
+ __free_page(chan->qdest_page);
+ ret = -ENOMEM;
+ goto out;
+ }
}
ref = kmalloc_obj(*ref);
--
2.55.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] dmaengine: ppc4xx: check dma_map_page() errors in probe
2026-09-10 21:43 [PATCH] dmaengine: ppc4xx: check dma_map_page() errors in probe Rosen Penev
@ 2026-09-11 16:05 ` Frank Li
2026-09-11 18:10 ` Rosen Penev
0 siblings, 1 reply; 3+ messages in thread
From: Frank Li @ 2026-09-11 16:05 UTC (permalink / raw)
To: Rosen Penev
Cc: dmaengine, Vinod Koul, Frank Li, Anatolij Gustschin,
Yuri Tikhonov, Dan Williams, open list
On Thu, Sep 10, 2026 at 02:43:34PM -0700, Rosen Penev wrote:
> In ppc440spe_adma_probe() the helper pages are mapped with
> dma_map_page() but the returned DMA address is never validated with
> dma_mapping_error(). On 440SPe the mapping goes through the
> SWIOTLB/direct map, which can fail under memory pressure or with an
> IOMMU, returning DMA_MAPPING_ERROR. The bogus address would then be
> programmed into the CDBs used by the async validation and
> mult/sum_product operations, causing the engine to DMA to or from
> arbitrary memory and corrupt data.
>
> Fail the probe when either mapping fails, freeing the pages and
> unmapping the first page if the second mapping fails.
>
> Fixes: 12458ea06efd7 ("ppc440spe-adma: adds updated ppc440spe adma driver")
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
> drivers/dma/ppc4xx/adma.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
> index 279a431ccae3..89e778896d7a 100644
> --- a/drivers/dma/ppc4xx/adma.c
> +++ b/drivers/dma/ppc4xx/adma.c
> @@ -4156,8 +4156,22 @@ static int ppc440spe_adma_probe(struct platform_device *ofdev)
> }
> chan->pdest = dma_map_page(&ofdev->dev, chan->pdest_page, 0,
> PAGE_SIZE, DMA_BIDIRECTIONAL);
> + if (dma_mapping_error(&ofdev->dev, chan->pdest)) {
> + __free_page(chan->pdest_page);
> + __free_page(chan->qdest_page);
put these to lable out
Frank
> + ret = -ENOMEM;
> + goto out;
> + }
> chan->qdest = dma_map_page(&ofdev->dev, chan->qdest_page, 0,
> PAGE_SIZE, DMA_BIDIRECTIONAL);
> + if (dma_mapping_error(&ofdev->dev, chan->qdest)) {
> + dma_unmap_page(&ofdev->dev, chan->pdest,
> + PAGE_SIZE, DMA_BIDIRECTIONAL);
> + __free_page(chan->pdest_page);
> + __free_page(chan->qdest_page);
> + ret = -ENOMEM;
> + goto out;
> + }
> }
>
> ref = kmalloc_obj(*ref);
> --
> 2.55.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] dmaengine: ppc4xx: check dma_map_page() errors in probe
2026-09-11 16:05 ` Frank Li
@ 2026-09-11 18:10 ` Rosen Penev
0 siblings, 0 replies; 3+ messages in thread
From: Rosen Penev @ 2026-09-11 18:10 UTC (permalink / raw)
To: Frank Li, Rosen Penev
Cc: dmaengine, Vinod Koul, Frank Li, Anatolij Gustschin,
Yuri Tikhonov, Dan Williams, open list
On Fri Sep 11, 2026 at 9:05 AM PDT, Frank Li wrote:
> On Thu, Sep 10, 2026 at 02:43:34PM -0700, Rosen Penev wrote:
>> In ppc440spe_adma_probe() the helper pages are mapped with
>> dma_map_page() but the returned DMA address is never validated with
>> dma_mapping_error(). On 440SPe the mapping goes through the
>> SWIOTLB/direct map, which can fail under memory pressure or with an
>> IOMMU, returning DMA_MAPPING_ERROR. The bogus address would then be
>> programmed into the CDBs used by the async validation and
>> mult/sum_product operations, causing the engine to DMA to or from
>> arbitrary memory and corrupt data.
>>
>> Fail the probe when either mapping fails, freeing the pages and
>> unmapping the first page if the second mapping fails.
>>
>> Fixes: 12458ea06efd7 ("ppc440spe-adma: adds updated ppc440spe adma driver")
>> Assisted-by: opencode:big-pickle
>> Signed-off-by: Rosen Penev <rosenp@gmail.com>
>> ---
>> drivers/dma/ppc4xx/adma.c | 14 ++++++++++++++
>> 1 file changed, 14 insertions(+)
>>
>> diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
>> index 279a431ccae3..89e778896d7a 100644
>> --- a/drivers/dma/ppc4xx/adma.c
>> +++ b/drivers/dma/ppc4xx/adma.c
>> @@ -4156,8 +4156,22 @@ static int ppc440spe_adma_probe(struct platform_device *ofdev)
>> }
>> chan->pdest = dma_map_page(&ofdev->dev, chan->pdest_page, 0,
>> PAGE_SIZE, DMA_BIDIRECTIONAL);
>> + if (dma_mapping_error(&ofdev->dev, chan->pdest)) {
>> + __free_page(chan->pdest_page);
>> + __free_page(chan->qdest_page);
>
> put these to lable out
Problem there is this is in an if statement. It's not as clean to handle
here directly.
>
> Frank
>
>> + ret = -ENOMEM;
>> + goto out;
>> + }
>> chan->qdest = dma_map_page(&ofdev->dev, chan->qdest_page, 0,
>> PAGE_SIZE, DMA_BIDIRECTIONAL);
>> + if (dma_mapping_error(&ofdev->dev, chan->qdest)) {
>> + dma_unmap_page(&ofdev->dev, chan->pdest,
>> + PAGE_SIZE, DMA_BIDIRECTIONAL);
>> + __free_page(chan->pdest_page);
>> + __free_page(chan->qdest_page);
>> + ret = -ENOMEM;
>> + goto out;
>> + }
>> }
>>
>> ref = kmalloc_obj(*ref);
>> --
>> 2.55.0
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-11 18:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-10 21:43 [PATCH] dmaengine: ppc4xx: check dma_map_page() errors in probe Rosen Penev
2026-09-11 16:05 ` Frank Li
2026-09-11 18:10 ` Rosen Penev
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®