| Message ID | 1434351560-29463-1-git-send-email-andrew_gabbasov@mentor.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
> -----Original Message----- > From: Gabbasov, Andrew > Sent: Monday, June 15, 2015 9:59 AM > To: linux-spi@vger.kernel.org > Subject: [PATCH] spi: Fix per-page mapping of unaligned vmalloc-ed buffer > > spi_map_buf() processes mapping of vmalloc-ed buffers in a special way, making > mapping of every page separately. However, if the buffer is not aligned to page > boundary (e.g. sub-array in a vmalloc-ed array), it fills the scatter table with > page-size unaligned pieces, that cross page boundaries. This is incorrect and > can, for example, cause memory corruption and various crashes when working > with ubifs on spi-nor chips. > > Fix this by using proper scatter table size and intra-page buffer lengths, so that > the whole buffer splits into separate scatter table entries on page boundaries. > > Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> > --- > drivers/spi/spi.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 50910d8..14016dc 100644 > --- a/drivers/spi/spi.c > +++ b/drivers/spi/spi.c > @@ -477,7 +477,9 @@ static int spi_map_buf(struct spi_master *master, struct > device *dev, { > const bool vmalloced_buf = is_vmalloc_addr(buf); > const int desc_len = vmalloced_buf ? PAGE_SIZE : master- > >max_dma_len; > - const int sgs = DIV_ROUND_UP(len, desc_len); > + const int sgs = DIV_ROUND_UP(vmalloced_buf ? > + len + offset_in_page(buf) : len, > + desc_len); > struct page *vm_page; > void *sg_buf; > size_t min; > @@ -488,9 +490,10 @@ static int spi_map_buf(struct spi_master *master, > struct device *dev, > return ret; > > for (i = 0; i < sgs; i++) { > - min = min_t(size_t, len, desc_len); > > if (vmalloced_buf) { > + min = min_t(size_t, > + len, desc_len - offset_in_page(buf)); > vm_page = vmalloc_to_page(buf); > if (!vm_page) { > sg_free_table(sgt); > @@ -499,6 +502,7 @@ static int spi_map_buf(struct spi_master *master, struct > device *dev, > sg_set_page(&sgt->sgl[i], vm_page, > min, offset_in_page(buf)); > } else { > + min = min_t(size_t, len, desc_len); > sg_buf = buf; > sg_set_buf(&sgt->sgl[i], sg_buf, min); > } > -- > 2.1.0 Any opinion on this fix? Thanks. Best regards, Andrew -- To unsubscribe from this list: send the line "unsubscribe linux-spi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jun 25, 2015 at 02:27:17PM +0300, Andrew Gabbasov wrote: > > -----Original Message----- > > From: Gabbasov, Andrew > Any opinion on this fix? Please don't quote entire messages, it makes it hard to find any new content you have added. If you want to submit a patch for inclusion in the kernel please follow the patch submission process in SubmittingPatches.
> Please don't quote entire messages, it makes it hard to find any new > content you have added. If you want to submit a patch for inclusion in > the kernel please follow the patch submission process in > SubmittingPatches. I did. This patch was sent to linux-spi mailing list twice (June 1 and June 15), and only after getting no response I asked the maintainer. Sorry if it's too early, but I believe the existing bug should be fixed. I'll submit the patch once more. Thanks. Best regards, Andrew -- To unsubscribe from this list: send the line "unsubscribe linux-spi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jun 25, 2015 at 03:57:50PM +0000, Gabbasov, Andrew wrote: > > Please don't quote entire messages, it makes it hard to find any new > > content you have added. If you want to submit a patch for inclusion in > > the kernel please follow the patch submission process in > > SubmittingPatches. > I did. This patch was sent to linux-spi mailing list twice (June 1 and June 15), > and only after getting no response I asked the maintainer. Sorry if it's too early, > but I believe the existing bug should be fixed. I'll submit the patch once more. SubmittingPatches says: | 5) Select the recipients for your patch. | ---------------------------------------- | | You should always copy the appropriate subsystem maintainer(s) on any patch | to code that they maintain; look through the MAINTAINERS file and the which you haven't done. If you don't send patches to people they won't see them and can't review them.
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 50910d8..14016dc 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -477,7 +477,9 @@ static int spi_map_buf(struct spi_master *master, struct device *dev, { const bool vmalloced_buf = is_vmalloc_addr(buf); const int desc_len = vmalloced_buf ? PAGE_SIZE : master->max_dma_len; - const int sgs = DIV_ROUND_UP(len, desc_len); + const int sgs = DIV_ROUND_UP(vmalloced_buf ? + len + offset_in_page(buf) : len, + desc_len); struct page *vm_page; void *sg_buf; size_t min; @@ -488,9 +490,10 @@ static int spi_map_buf(struct spi_master *master, struct device *dev, return ret; for (i = 0; i < sgs; i++) { - min = min_t(size_t, len, desc_len); if (vmalloced_buf) { + min = min_t(size_t, + len, desc_len - offset_in_page(buf)); vm_page = vmalloc_to_page(buf); if (!vm_page) { sg_free_table(sgt); @@ -499,6 +502,7 @@ static int spi_map_buf(struct spi_master *master, struct device *dev, sg_set_page(&sgt->sgl[i], vm_page, min, offset_in_page(buf)); } else { + min = min_t(size_t, len, desc_len); sg_buf = buf; sg_set_buf(&sgt->sgl[i], sg_buf, min); }
spi_map_buf() processes mapping of vmalloc-ed buffers in a special way, making mapping of every page separately. However, if the buffer is not aligned to page boundary (e.g. sub-array in a vmalloc-ed array), it fills the scatter table with page-size unaligned pieces, that cross page boundaries. This is incorrect and can, for example, cause memory corruption and various crashes when working with ubifs on spi-nor chips. Fix this by using proper scatter table size and intra-page buffer lengths, so that the whole buffer splits into separate scatter table entries on page boundaries. Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> --- drivers/spi/spi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)