Message ID | 20240815081951.10261-1-massimiliano.pellizzer@canonical.com |
---|---|
Headers | show |
Series | CVE-2024-26787 | expand |
On Thu, Aug 15, 2024 at 10:19:16AM +0200, Massimiliano Pellizzer wrote: > [Impact] > > mmc: mmci: stm32: fix DMA API overlapping mappings warning > > Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: > > DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, > overlapping mappings aren't supported > WARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568 > add_dma_entry+0x234/0x2f4 > Modules linked in: > CPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1 > Hardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT) > Workqueue: events_freezable mmc_rescan > Call trace: > add_dma_entry+0x234/0x2f4 > debug_dma_map_sg+0x198/0x350 > __dma_map_sg_attrs+0xa0/0x110 > dma_map_sg_attrs+0x10/0x2c > sdmmc_idma_prep_data+0x80/0xc0 > mmci_prep_data+0x38/0x84 > mmci_start_data+0x108/0x2dc > mmci_request+0xe4/0x190 > __mmc_start_request+0x68/0x140 > mmc_start_request+0x94/0xc0 > mmc_wait_for_req+0x70/0x100 > mmc_send_tuning+0x108/0x1ac > sdmmc_execute_tuning+0x14c/0x210 > mmc_execute_tuning+0x48/0xec > mmc_sd_init_uhs_card.part.0+0x208/0x464 > mmc_sd_init_card+0x318/0x89c > mmc_attach_sd+0xe4/0x180 > mmc_rescan+0x244/0x320 > > DMA API debug brings to light leaking dma-mappings as dma_map_sg and > dma_unmap_sg are not correctly balanced. > > If an error occurs in mmci_cmd_irq function, only mmci_dma_error > function is called and as this API is not managed on stm32 variant, > dma_unmap_sg is never called in this error path. > > [Fix] > > Noble: Not affected > Jammy: Fixed > Focal: Clean cherry pick of two prereqs, and clean cherry pick of the > fix commit > Bionic: Not affected > Xenial: Not affected > > [Test Case] > > Compile and boot tested. > > [Where problems could occur] > > The fix affects the driver responsible for managing the MMC/SD host > controller found on STM32 microcontrollers. An issue with this fix > therefore may lead to data corruption during SD/MMC card operations and > possibly to system crashes. > > Christophe Kerello (1): > mmc: mmci: stm32: fix DMA API overlapping mappings warning > > Ludovic Barre (1): > mmc: mmci_sdmmc: Rename sdmmc_priv struct to sdmmc_idma > > Yann Gautier (1): > mmc: mmci: stm32: use a buffer for unaligned DMA requests > > drivers/mmc/host/mmci_stm32_sdmmc.c | 118 +++++++++++++++++++++++----- > 1 file changed, 98 insertions(+), 20 deletions(-) > > -- > 2.43.0 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team Acked-by: Manuel Diewald <manuel.diewald@canonical.com>
On Thu, Aug 15, 2024 at 10:19:16AM +0200, Massimiliano Pellizzer wrote: > [Impact] > > mmc: mmci: stm32: fix DMA API overlapping mappings warning > > Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: > > DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, > overlapping mappings aren't supported > WARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568 > add_dma_entry+0x234/0x2f4 > Modules linked in: > CPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1 > Hardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT) > Workqueue: events_freezable mmc_rescan > Call trace: > add_dma_entry+0x234/0x2f4 > debug_dma_map_sg+0x198/0x350 > __dma_map_sg_attrs+0xa0/0x110 > dma_map_sg_attrs+0x10/0x2c > sdmmc_idma_prep_data+0x80/0xc0 > mmci_prep_data+0x38/0x84 > mmci_start_data+0x108/0x2dc > mmci_request+0xe4/0x190 > __mmc_start_request+0x68/0x140 > mmc_start_request+0x94/0xc0 > mmc_wait_for_req+0x70/0x100 > mmc_send_tuning+0x108/0x1ac > sdmmc_execute_tuning+0x14c/0x210 > mmc_execute_tuning+0x48/0xec > mmc_sd_init_uhs_card.part.0+0x208/0x464 > mmc_sd_init_card+0x318/0x89c > mmc_attach_sd+0xe4/0x180 > mmc_rescan+0x244/0x320 > > DMA API debug brings to light leaking dma-mappings as dma_map_sg and > dma_unmap_sg are not correctly balanced. > > If an error occurs in mmci_cmd_irq function, only mmci_dma_error > function is called and as this API is not managed on stm32 variant, > dma_unmap_sg is never called in this error path. > > [Fix] > > Noble: Not affected > Jammy: Fixed > Focal: Clean cherry pick of two prereqs, and clean cherry pick of the > fix commit > Bionic: Not affected > Xenial: Not affected > > [Test Case] > > Compile and boot tested. > > [Where problems could occur] > > The fix affects the driver responsible for managing the MMC/SD host > controller found on STM32 microcontrollers. An issue with this fix > therefore may lead to data corruption during SD/MMC card operations and > possibly to system crashes. > > Christophe Kerello (1): > mmc: mmci: stm32: fix DMA API overlapping mappings warning > > Ludovic Barre (1): > mmc: mmci_sdmmc: Rename sdmmc_priv struct to sdmmc_idma > > Yann Gautier (1): > mmc: mmci: stm32: use a buffer for unaligned DMA requests > > drivers/mmc/host/mmci_stm32_sdmmc.c | 118 +++++++++++++++++++++++----- > 1 file changed, 98 insertions(+), 20 deletions(-) Acked-by: Kuan-Ying Lee <kuan-ying.lee@canonical.com>
On 15.08.24 10:19, Massimiliano Pellizzer wrote: > [Impact] > > mmc: mmci: stm32: fix DMA API overlapping mappings warning > > Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: > > DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, > overlapping mappings aren't supported > WARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568 > add_dma_entry+0x234/0x2f4 > Modules linked in: > CPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1 > Hardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT) > Workqueue: events_freezable mmc_rescan > Call trace: > add_dma_entry+0x234/0x2f4 > debug_dma_map_sg+0x198/0x350 > __dma_map_sg_attrs+0xa0/0x110 > dma_map_sg_attrs+0x10/0x2c > sdmmc_idma_prep_data+0x80/0xc0 > mmci_prep_data+0x38/0x84 > mmci_start_data+0x108/0x2dc > mmci_request+0xe4/0x190 > __mmc_start_request+0x68/0x140 > mmc_start_request+0x94/0xc0 > mmc_wait_for_req+0x70/0x100 > mmc_send_tuning+0x108/0x1ac > sdmmc_execute_tuning+0x14c/0x210 > mmc_execute_tuning+0x48/0xec > mmc_sd_init_uhs_card.part.0+0x208/0x464 > mmc_sd_init_card+0x318/0x89c > mmc_attach_sd+0xe4/0x180 > mmc_rescan+0x244/0x320 > > DMA API debug brings to light leaking dma-mappings as dma_map_sg and > dma_unmap_sg are not correctly balanced. > > If an error occurs in mmci_cmd_irq function, only mmci_dma_error > function is called and as this API is not managed on stm32 variant, > dma_unmap_sg is never called in this error path. > > [Fix] > > Noble: Not affected > Jammy: Fixed > Focal: Clean cherry pick of two prereqs, and clean cherry pick of the > fix commit > Bionic: Not affected > Xenial: Not affected > > [Test Case] > > Compile and boot tested. > > [Where problems could occur] > > The fix affects the driver responsible for managing the MMC/SD host > controller found on STM32 microcontrollers. An issue with this fix > therefore may lead to data corruption during SD/MMC card operations and > possibly to system crashes. > > Christophe Kerello (1): > mmc: mmci: stm32: fix DMA API overlapping mappings warning > > Ludovic Barre (1): > mmc: mmci_sdmmc: Rename sdmmc_priv struct to sdmmc_idma > > Yann Gautier (1): > mmc: mmci: stm32: use a buffer for unaligned DMA requests > > drivers/mmc/host/mmci_stm32_sdmmc.c | 118 +++++++++++++++++++++++----- > 1 file changed, 98 insertions(+), 20 deletions(-) > Applied to focal:linux/master-next. Thanks. -Stefan