1 files changed, 8 insertions, 4 deletions

diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index 6f7d4e977c5c..8b1360772fc5 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -587,10 +587,14 @@ found:
          */
         for (i = 0; i < nslots; i++)
                 io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT);
-        if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) &&
-            (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL))
-                swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
-
+        /*
+         * When dir == DMA_FROM_DEVICE we could omit the copy from the orig
+         * to the tlb buffer, if we knew for sure the device will
+         * overwirte the entire current content. But we don't. Thus
+         * unconditional bounce may prevent leaking swiotlb content (i.e.
+         * kernel memory) to user-space.
+         */
+        swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
         return tlb_addr;
 }