From patchwork Tue May 2 16:29:32 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tycho Andersen X-Patchwork-Id: 9708309 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A379A6021C for ; Tue, 2 May 2017 16:31:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 95CDF2846C for ; Tue, 2 May 2017 16:31:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8A6DB284D5; Tue, 2 May 2017 16:31:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id A0F622846C for ; Tue, 2 May 2017 16:31:47 +0000 (UTC) Received: (qmail 23986 invoked by uid 550); 2 May 2017 16:31:45 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 23948 invoked from network); 2 May 2017 16:31:44 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=docker.com; s=google; h=from:to:cc:subject:date:message-id; bh=23BQCbVj3CZipqZgT1UTGHL5WQmllVP1AL29GGkONr8=; b=EcEcRzHPxWLXU/OSKe7Cz+h3jB2GArUOeqXyawJ4QWa8//gW7yTQxx9r8n6i+x78Cb 0c7faAYJq8jz/AWtMsQM4GAY7iAUk3aqTAMyRzoiJZvXbhxkYH/QHz9sXp2mOoIb/rbB df+8y/Mdt7swe/Y1QnzQrfPfENFO/TFnbkLZo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=23BQCbVj3CZipqZgT1UTGHL5WQmllVP1AL29GGkONr8=; b=YvQjXM/kInEBYWB3bz7JWizG+RjGYFk1nQ6R3PA5rWrB3yIKP/MLG/R1RCj2PLJEum nJC72fC0Tcld+LlAJzkrqJra0LgPeHwX5fccLpI6FwY4/GGvwHf/6cHAAxpmwrleK3QI kERYlhiVM2bDwdGYT4srujY2x6AzCS4dYnnk3NIE8u2gNntW0rxA4UZV7vQLibb77W94 QiGp24gcmkk7J0zj18FzMIKqYjmO+m91/eCt+rSTpEwYL69VHPikWvv4mtTsiYDNHcxX 1P3QczC0uw3N5bsElLqMJWmi75TuOSC/vGEUc2s/EOv29L+ElY00YbnSdip5Zxce7F6j 5rTA== X-Gm-Message-State: AN3rC/5MNhDmAWxsdgT4lBJT8zRt6iUSazsS6UX3cEJlDyB/xEKaO1/T TWQGRyIlzdvUKskS X-Received: by 10.107.201.143 with SMTP id z137mr1209705iof.220.1493742691857; Tue, 02 May 2017 09:31:31 -0700 (PDT) From: Tycho Andersen To: Tejun Heo , Juerg Haefliger Cc: linux-ide@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Tycho Andersen Date: Tue, 2 May 2017 10:29:32 -0600 Message-Id: <20170502162932.12578-1-tycho@docker.com> X-Mailer: git-send-email 2.9.3 Subject: [kernel-hardening] [PATCH] ata-sff: always map page before data transfer X-Virus-Scanned: ClamAV using ClamSMTP The XPFO [1] patchset may unmap pages from physmap if they happened to be destined for userspace. If such a page is unmapped, it needs to be remapped. Rather than test if a page is in the highmem/xpfo unmapped state, Christoph suggested [2] that we simply always map the page. Suggested-by: Christoph Hellwig Signed-off-by: Tycho Andersen CC: Juerg Haefliger CC: Tejun Heo [1]: https://lkml.org/lkml/2016/11/4/245 [2]: https://lkml.org/lkml/2016/11/4/253 --- I don't understand all the factors at play here, so thoughts are definitely welcome. --- drivers/ata/libata-sff.c | 50 +++++++++++++++++------------------------------- 1 file changed, 18 insertions(+), 32 deletions(-) diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c index 2bd92dc..8da2572 100644 --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -703,6 +703,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) struct page *page; unsigned int offset; unsigned char *buf; + unsigned long flags; if (qc->curbytes == qc->nbytes - qc->sect_size) ap->hsm_task_state = HSM_ST_LAST; @@ -716,24 +717,16 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) DPRINTK("data %s\n", qc->tf.flags & ATA_TFLAG_WRITE ? "write" : "read"); - if (PageHighMem(page)) { - unsigned long flags; - - /* FIXME: use a bounce buffer */ - local_irq_save(flags); - buf = kmap_atomic(page); + /* FIXME: use a bounce buffer */ + local_irq_save(flags); + buf = kmap_atomic(page); - /* do the actual data transfer */ - ap->ops->sff_data_xfer(qc, buf + offset, qc->sect_size, - do_write); + /* do the actual data transfer */ + ap->ops->sff_data_xfer(qc, buf + offset, qc->sect_size, + do_write); - kunmap_atomic(buf); - local_irq_restore(flags); - } else { - buf = page_address(page); - ap->ops->sff_data_xfer(qc, buf + offset, qc->sect_size, - do_write); - } + kunmap_atomic(buf); + local_irq_restore(flags); if (!do_write && !PageSlab(page)) flush_dcache_page(page); @@ -836,6 +829,7 @@ static int __atapi_pio_bytes(struct ata_queued_cmd *qc, unsigned int bytes) struct page *page; unsigned char *buf; unsigned int offset, count, consumed; + unsigned long flags; next_sg: sg = qc->cursg; @@ -861,24 +855,16 @@ static int __atapi_pio_bytes(struct ata_queued_cmd *qc, unsigned int bytes) DPRINTK("data %s\n", qc->tf.flags & ATA_TFLAG_WRITE ? "write" : "read"); - if (PageHighMem(page)) { - unsigned long flags; - - /* FIXME: use bounce buffer */ - local_irq_save(flags); - buf = kmap_atomic(page); + /* FIXME: use bounce buffer */ + local_irq_save(flags); + buf = kmap_atomic(page); - /* do the actual data transfer */ - consumed = ap->ops->sff_data_xfer(qc, buf + offset, - count, rw); + /* do the actual data transfer */ + consumed = ap->ops->sff_data_xfer(qc, buf + offset, + count, rw); - kunmap_atomic(buf); - local_irq_restore(flags); - } else { - buf = page_address(page); - consumed = ap->ops->sff_data_xfer(qc, buf + offset, - count, rw); - } + kunmap_atomic(buf); + local_irq_restore(flags); bytes -= min(bytes, consumed); qc->curbytes += count;