b5cc57e43f
commit 0c7d7cc2b4fe2e74ef8728f030f0f1674f9f6aee upstream.
There are two problems with the current code of memory_intersects:
First, it doesn't check whether the region (begin, end) falls inside the
region (virt, vend), that is (virt < begin && vend > end).
The second problem is if vend is equal to begin, it will return true but
this is wrong since vend (virt + size) is not the last address of the
memory region but (virt + size -1) is. The wrong determination will
trigger the misreporting when the function check_for_illegal_area calls
memory_intersects to check if the dma region intersects with stext region.
The misreporting is as below (stext is at 0x80100000):
WARNING: CPU: 0 PID: 77 at kernel/dma/debug.c:1073 check_for_illegal_area+0x130/0x168
DMA-API: chipidea-usb2 e0002000.usb: device driver maps memory from kernel text or rodata [addr=800f0000] [len=65536]
Modules linked in:
CPU: 1 PID: 77 Comm: usb-storage Not tainted 5.19.0-yocto-standard #5
Hardware name: Xilinx Zynq Platform
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x58/0x70
dump_stack_lvl from __warn+0xb0/0x198
__warn from warn_slowpath_fmt+0x80/0xb4
warn_slowpath_fmt from check_for_illegal_area+0x130/0x168
check_for_illegal_area from debug_dma_map_sg+0x94/0x368
debug_dma_map_sg from __dma_map_sg_attrs+0x114/0x128
__dma_map_sg_attrs from dma_map_sg_attrs+0x18/0x24
dma_map_sg_attrs from usb_hcd_map_urb_for_dma+0x250/0x3b4
usb_hcd_map_urb_for_dma from usb_hcd_submit_urb+0x194/0x214
usb_hcd_submit_urb from usb_sg_wait+0xa4/0x118
usb_sg_wait from usb_stor_bulk_transfer_sglist+0xa0/0xec
usb_stor_bulk_transfer_sglist from usb_stor_bulk_srb+0x38/0x70
usb_stor_bulk_srb from usb_stor_Bulk_transport+0x150/0x360
usb_stor_Bulk_transport from usb_stor_invoke_transport+0x38/0x440
usb_stor_invoke_transport from usb_stor_control_thread+0x1e0/0x238
usb_stor_control_thread from kthread+0xf8/0x104
kthread from ret_from_fork+0x14/0x2c
Refactor memory_intersects to fix the two problems above.
Before the 1d7db834a027e ("dma-debug: use memory_intersects()
directly"), memory_intersects is called only by printk_late_init:
printk_late_init -> init_section_intersects ->memory_intersects.
There were few places where memory_intersects was called.
When commit 1d7db834a027e ("dma-debug: use memory_intersects()
directly") was merged and CONFIG_DMA_API_DEBUG is enabled, the DMA
subsystem uses it to check for an illegal area and the calltrace above
is triggered.
[akpm@linux-foundation.org: fix nearby comment typo]
Link: https://lkml.kernel.org/r/20220819081145.948016-1-quanyang.wang@windriver.com
Fixes:
|
||
---|---|---|
.. | ||
bitops | ||
4level-fixup.h | ||
5level-fixup.h | ||
asm-offsets.h | ||
asm-prototypes.h | ||
atomic64.h | ||
atomic-instrumented.h | ||
atomic-long.h | ||
atomic.h | ||
audit_change_attr.h | ||
audit_dir_write.h | ||
audit_read.h | ||
audit_signal.h | ||
audit_write.h | ||
barrier.h | ||
bitops.h | ||
bitsperlong.h | ||
bug.h | ||
bugs.h | ||
cache.h | ||
cacheflush.h | ||
checksum.h | ||
cmpxchg-local.h | ||
cmpxchg.h | ||
compat.h | ||
current.h | ||
delay.h | ||
device.h | ||
div64.h | ||
dma-contiguous.h | ||
dma-mapping.h | ||
dma.h | ||
early_ioremap.h | ||
emergency-restart.h | ||
error-injection.h | ||
exec.h | ||
export.h | ||
extable.h | ||
fb.h | ||
fixmap.h | ||
ftrace.h | ||
futex.h | ||
getorder.h | ||
gpio.h | ||
hardirq.h | ||
hugetlb.h | ||
hw_irq.h | ||
ide_iops.h | ||
int-ll64.h | ||
io.h | ||
ioctl.h | ||
iomap.h | ||
irq_regs.h | ||
irq_work.h | ||
irq.h | ||
irqflags.h | ||
kdebug.h | ||
kmap_types.h | ||
kprobes.h | ||
kvm_para.h | ||
linkage.h | ||
local64.h | ||
local.h | ||
mcs_spinlock.h | ||
memory_model.h | ||
mm_hooks.h | ||
mm-arch-hooks.h | ||
mmu_context.h | ||
mmu.h | ||
module.h | ||
msi.h | ||
page.h | ||
param.h | ||
parport.h | ||
pci_iomap.h | ||
pci.h | ||
percpu.h | ||
pgalloc.h | ||
pgtable-nop4d-hack.h | ||
pgtable-nop4d.h | ||
pgtable-nopmd.h | ||
pgtable-nopud.h | ||
pgtable.h | ||
preempt.h | ||
ptrace.h | ||
qrwlock_types.h | ||
qrwlock.h | ||
qspinlock_types.h | ||
qspinlock.h | ||
resource.h | ||
rwsem.h | ||
seccomp.h | ||
sections.h | ||
segment.h | ||
serial.h | ||
set_memory.h | ||
signal.h | ||
simd.h | ||
sizes.h | ||
spinlock.h | ||
statfs.h | ||
string.h | ||
switch_to.h | ||
syscall.h | ||
syscalls.h | ||
termios-base.h | ||
termios.h | ||
timex.h | ||
tlb.h | ||
tlbflush.h | ||
topology.h | ||
trace_clock.h | ||
uaccess.h | ||
unaligned.h | ||
unistd.h | ||
user.h | ||
vga.h | ||
vmlinux.lds.h | ||
vtime.h | ||
word-at-a-time.h | ||
xor.h |