From nobody Tue Apr 7 06:23:04 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB106224AF7 for ; Sun, 15 Mar 2026 08:28:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773563326; cv=none; b=mDCpcTxLpf/MqLAtug1Hb5eOR53+X45Ybcu9a4A8mDoirOeT5POF7qjEU3M7Ik4Yc7zQT33VcYYIbrmwY+VEeZOlsFwOmGZXctKaFuPtlc+aahOTCQnbcpS7H3ISHLV2lOzssTcWJLzN8spLJPu0MlRfOhtGGzPfGXf2nYwHmhs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773563326; c=relaxed/simple; bh=HFCmm9+lNAJNhfV7fOVO/gE32UV6UExhiS6HRHN+uo0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=auPPkrcjI+qUgke1+Wt+0ZgHmPNiv95TZASPW04taxS5MrublooJtKML7f9NCItn+QQSIxA/NYB1VtAvCZGYrW4xCzsrmAxKDi3G4ItOCWfQElshHkBnvqbzjyolz/Isjt728eXW9wgzb6+LJNnGswfZg392M6b1VfkwWvvqRAo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Yi033OE7; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=IsdDeC+Q; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Yi033OE7"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="IsdDeC+Q" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1773563324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=sT1fz+nZNL5Xr4YwRtI6wr1LjR6m/sM+MT7k5Awq2j8=; b=Yi033OE7RMXlZU97S8+EbGZkYUdLj3XvEye8BrrVENQE7C7nqDwGafGOcnUrMTlKmLUph+ 67F1bheLh5zutYlnd2yzU/OxPEcS8pdftxgITF2aEWRTHg/4qYaAAyvPO/0TLenNeRp6ft 2DDanEn6KARNFgQenyuOw22FrXIIml8= Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-609-W8YcqfP9MZSIuLlNExzfqg-1; Sun, 15 Mar 2026 04:28:42 -0400 X-MC-Unique: W8YcqfP9MZSIuLlNExzfqg-1 X-Mimecast-MFC-AGG-ID: W8YcqfP9MZSIuLlNExzfqg_1773563321 Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-35449510446so3032661a91.0 for ; Sun, 15 Mar 2026 01:28:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1773563321; x=1774168121; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=sT1fz+nZNL5Xr4YwRtI6wr1LjR6m/sM+MT7k5Awq2j8=; b=IsdDeC+Q3oXrU0IydtETlnaMao+DjRWyJFC9Fve+z8PcWedeMUFHQgsgLY9rHJ3MM4 VGzmXfLsf9t4bgu+BEQ1swt7aQe+0vwM5qqZ+mdRNcLR5CSkg8/0X7axrenP5hNMR6Ye wNKdcY7ZSHiX7kSvVI2FINbuHrvA9/YuKRv4VhZbfS4ZBnqbGaOSH/kT2fPympdpymZJ i9D1yCiOJ9TQX55a8Q7WEZBAEUOHAYpf1Usp72bds9g2LRiZiYdBJKdmLsacoAbwFAXN ZUW+QbUA1N4YM3AWmm8WyvoHFiG5t+XeCh9TwGdT1sLxz3wbSIAdNcykcgNZCMnCZNp2 b8EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773563321; x=1774168121; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=sT1fz+nZNL5Xr4YwRtI6wr1LjR6m/sM+MT7k5Awq2j8=; b=cxv1dVjP2VQI9FmVVlRdHoqM0RO5QG8elzuBMZBVowXeBKfRb2G4xCntjIFOg6lUC/ H01e78E3Bo8JfVfbbT2tSOQI5Dq8LIJ7ytKelFPXJ8bESAtsjxCzydSF8GMPACfuzJwT 7TzKPpgU5lM1VODhf3DmicuRrxqlx4p+p/2Pfrz+FJIzjaRV3Is+cfPyf7JCAJ0IKcfv uUrzWFs7suw8AS4X/tdo1HwT2xFHV48tskXzx/O8jSG6VOUdJWl1pOUD0rRxoDdgtrqY RlW7zZFgAtWWGnYdJmaG6JtXEEX2XeL+XNBVWKmFR43kpOOW+hqA2gsvdHKBmLilBmeX j3aA== X-Forwarded-Encrypted: i=1; AJvYcCXxguCZwmIh0CH6XctYQ5KcJVSCIZWcpJQ4SKGraHZnYxI+Lg5WYpu9bOHavvCmnouCL/PYpP39qSr5Y8U=@vger.kernel.org X-Gm-Message-State: AOJu0YwG6idT+IZRg+ks21Woh2MSXTNV3Uz5qsrZqWRbQV8UvSIW7ffg Va3yJ8p9d/G9RYegE6Zb+VSXADVBFszjQ/xqfToqNhHrWtry1zH37oN+t2kC5ZJWph6P7+ompIz Yd34AGe0GAOJ7lbZhq/dLl0xpCYWGX+OqmxLpUgeIGdAZutdLCST+Zz7kpKU3lgL1jQif+owtpA == X-Gm-Gg: ATEYQzw3YYrR5TvY+LO5RnEIHMcLnWZFX069b9H2kRIkqmxIY9qAOBt3SF/qUcBY8US ApzlLRRQWHfjWtR23x/dZ0rYFl6PBJrpV/dE/0noinHA4FCm1cA3R4XV4p67EYziTGH0iKx/gV+ KXPse96j2+QBzNpCWynJ2bZ5v29rcZlX6KH/S5Y/homKGrm82l4DmSjkNIVbyz/NqcxNDPoW3qF Bj3yMVHZdDok01l/Kpbl1JvPOa8u8yKqOT1IIoDCWicQzs8lNqXVeg8saKsJbleIVwXlPWJYbH/ cxdwmzpMRo6WLv4N77Y1wbhaCurJ0FJS5ZrU4k6koIhXHS78llekLYPvzSLXrWI+99jQO7VHD7Z HyFQvgdq3PPURUcq3hB7mKVtH+YEv3GpNoewr5qtqEKAIJw== X-Received: by 2002:a17:90b:1f8c:b0:359:8d70:c4e6 with SMTP id 98e67ed59e1d1-35a21e485e2mr8227106a91.1.1773563321211; Sun, 15 Mar 2026 01:28:41 -0700 (PDT) X-Received: by 2002:a17:90b:1f8c:b0:359:8d70:c4e6 with SMTP id 98e67ed59e1d1-35a21e485e2mr8227093a91.1.1773563320779; Sun, 15 Mar 2026 01:28:40 -0700 (PDT) Received: from kernel-devel.tail62cea.ts.net ([240d:1a:c0d:9f00:be24:11ff:fe35:71b3]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-35b95822ca2sm579919a91.4.2026.03.15.01.28.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 15 Mar 2026 01:28:40 -0700 (PDT) From: Shigeru Yoshida To: Marek Szyprowski , Robin Murphy , Andrew Morton , Alexander Potapenko Cc: Shigeru Yoshida , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH] dma: swiotlb: add KMSAN annotations to swiotlb_bounce() Date: Sun, 15 Mar 2026 17:27:49 +0900 Message-ID: <20260315082750.2375581-1-syoshida@redhat.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a device performs DMA to a bounce buffer, KMSAN is unaware of the write and does not mark the data as initialized. When swiotlb_bounce() later copies the bounce buffer back to the original buffer, memcpy propagates the uninitialized shadow to the original buffer, causing false positive uninit-value reports. Fix this by calling kmsan_unpoison_memory() on the bounce buffer before copying it back in the DMA_FROM_DEVICE path, so that memcpy naturally propagates initialized shadow to the destination. Suggested-by: Alexander Potapenko Link: https://lore.kernel.org/CAG_fn=3DWUGta-paG1BgsGRoAR+fmuCgh3xo=3DR3Xdz= Ot_-DqSdHw@mail.gmail.com/ Fixes: 7ade4f10779c ("dma: kmsan: unpoison DMA mappings") Signed-off-by: Shigeru Yoshida --- kernel/dma/swiotlb.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index d8e6f1d889d5..9fd73700ddcf 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include @@ -901,10 +902,19 @@ static void swiotlb_bounce(struct device *dev, phys_a= ddr_t tlb_addr, size_t size =20 local_irq_save(flags); page =3D pfn_to_page(pfn); - if (dir =3D=3D DMA_TO_DEVICE) + if (dir =3D=3D DMA_TO_DEVICE) { + /* + * Ideally, kmsan_check_highmem_page() + * could be used here to detect infoleaks, + * but callers may map uninitialized buffers + * that will be written by the device, + * causing false positives. + */ memcpy_from_page(vaddr, page, offset, sz); - else + } else { + kmsan_unpoison_memory(vaddr, sz); memcpy_to_page(page, offset, vaddr, sz); + } local_irq_restore(flags); =20 size -=3D sz; @@ -913,8 +923,15 @@ static void swiotlb_bounce(struct device *dev, phys_ad= dr_t tlb_addr, size_t size offset =3D 0; } } else if (dir =3D=3D DMA_TO_DEVICE) { + /* + * Ideally, kmsan_check_memory() could be used here to detect + * infoleaks (uninitialized data being sent to device), but + * callers may map uninitialized buffers that will be written + * by the device, causing false positives. + */ memcpy(vaddr, phys_to_virt(orig_addr), size); } else { + kmsan_unpoison_memory(vaddr, size); memcpy(phys_to_virt(orig_addr), vaddr, size); } } --=20 2.52.0