Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

dma-debug: update DMA debug API to better handle multiple mappings of a buffer

There were reports of the igb driver unmapping buffers without calling
dma_mapping_error. On closer inspection issues were found in the DMA
debug API and how it handled multiple mappings of the same buffer.

The issue I found is the fact that the debug_dma_mapping_error would
only set the map_err_type to MAP_ERR_CHECKED in the case that the was
only one match for device and device address. However in the case of
non-IOMMU, multiple addresses existed and as a result it was not setting
this field once a second mapping was instantiated. I have resolved this
by changing the search so that it instead will now set MAP_ERR_CHECKED
on the first buffer that matches the device and DMA address that is
currently in the state MAP_ERR_NOT_CHECKED.

A secondary side effect of this patch is that in the case of multiple
buffers using the same address only the last mapping will have a valid
map_err_type. The previous mappings will all end up with map_err_type
set to MAP_ERR_CHECKED because of the dma_mapping_error call in
debug_dma_map_page. However this behavior may be preferable as it means
you will likely only see one real error per multi-mapped buffer, versus
the current behavior of multiple false errors mer multi-mapped buffer.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Joerg Roedel <joro@8bytes.org>
Reviewed-by: Shuah Khan <shuah.khan@hp.com>
Tested-by: Shuah Khan <shuah.khan@hp.com>
Cc: Jakub Kicinski <kubakici@wp.pl>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Alexander Duyck and committed by
Linus Torvalds
96e7d7a1 8d640a51

+19 -5
+19 -5
lib/dma-debug.c
··· 1085 1085 ref.dev = dev; 1086 1086 ref.dev_addr = dma_addr; 1087 1087 bucket = get_hash_bucket(&ref, &flags); 1088 - entry = bucket_find_exact(bucket, &ref); 1089 1088 1090 - if (!entry) 1091 - goto out; 1089 + list_for_each_entry(entry, &bucket->list, list) { 1090 + if (!exact_match(&ref, entry)) 1091 + continue; 1092 1092 1093 - entry->map_err_type = MAP_ERR_CHECKED; 1094 - out: 1093 + /* 1094 + * The same physical address can be mapped multiple 1095 + * times. Without a hardware IOMMU this results in the 1096 + * same device addresses being put into the dma-debug 1097 + * hash multiple times too. This can result in false 1098 + * positives being reported. Therefore we implement a 1099 + * best-fit algorithm here which updates the first entry 1100 + * from the hash which fits the reference value and is 1101 + * not currently listed as being checked. 1102 + */ 1103 + if (entry->map_err_type == MAP_ERR_NOT_CHECKED) { 1104 + entry->map_err_type = MAP_ERR_CHECKED; 1105 + break; 1106 + } 1107 + } 1108 + 1095 1109 put_hash_bucket(bucket, &flags); 1096 1110 } 1097 1111 EXPORT_SYMBOL(debug_dma_mapping_error);