mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/iommu
History
Jason Gunthorpe 13a0d1ae7e iommufd: Do not corrupt the pfn list when doing batch carry 
If batch->end is 0 then setting npfns[0] before computing the new value of
pfns will fail to adjust the pfn and result in various page accounting
corruptions. It should be ordered after.

This seems to result in various kinds of page meta-data corruption related
failures:

  WARNING: CPU: 1 PID: 527 at mm/gup.c:75 try_grab_folio+0x503/0x740
  Modules linked in:
  CPU: 1 PID: 527 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
  RIP: 0010:try_grab_folio+0x503/0x740
  Code: e3 01 48 89 de e8 6d c1 dd ff 48 85 db 0f 84 7c fe ff ff e8 4f bf dd ff 49 8d 47 ff 48 89 45 d0 e9 73 fe ff ff e8 3d bf dd ff <0f> 0b 31 db e9 d0 fc ff ff e8 2f bf dd ff 48 8b 5d c8 31 ff 48 89
  RSP: 0018:ffffc90000f37908 EFLAGS: 00010046
  RAX: 0000000000000000 RBX: 00000000fffffc02 RCX: ffffffff81504c26
  RDX: 0000000000000000 RSI: ffff88800d030000 RDI: 0000000000000002
  RBP: ffffc90000f37948 R08: 000000000003ca24 R09: 0000000000000008
  R10: 000000000003ca00 R11: 0000000000000023 R12: ffffea000035d540
  R13: 0000000000000001 R14: 0000000000000000 R15: ffffea000035d540
  FS:  00007fecbf659740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000200011c3 CR3: 000000000ef66006 CR4: 0000000000770ee0
  PKRU: 55555554
  Call Trace:
   <TASK>
   internal_get_user_pages_fast+0xd32/0x2200
   pin_user_pages_fast+0x65/0x90
   pfn_reader_user_pin+0x376/0x390
   pfn_reader_next+0x14a/0x7b0
   pfn_reader_first+0x140/0x1b0
   iopt_area_fill_domain+0x74/0x210
   iopt_table_add_domain+0x30e/0x6e0
   iommufd_device_selftest_attach+0x7f/0x140
   iommufd_test+0x10ff/0x16f0
   iommufd_fops_ioctl+0x206/0x330
   __x64_sys_ioctl+0x10e/0x160
   do_syscall_64+0x3b/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

Cc: <stable@vger.kernel.org>
Fixes: f394576eb1 ("iommufd: PFN handling for iopt_pages")
Link: https://lore.kernel.org/r/3-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
 		2023-04-04 09:10:55 -03:00
..
amd iommufd for 6.3 2023-02-24 14:34:12 -08:00
arm ARM: SoC drivers for 6.3 2023-02-27 10:04:49 -08:00
intel iommu/vt-d: Fix an IOMMU perfmon warning when CPU hotplug 2023-03-31 10:06:16 +02:00
iommufd iommufd: Do not corrupt the pfn list when doing batch carry 2023-04-04 09:10:55 -03:00
Kconfig iommu: Tidy up io-pgtable dependencies 2023-01-13 16:59:48 +01:00
Makefile iommufd: File descriptor, context, kconfig and makefiles 2022-11-30 20:16:49 -04:00
apple-dart.c Merge branches 'apple/dart', 'arm/exynos', 'arm/renesas', 'arm/smmu', 'x86/vt-d', 'x86/amd' and 'core' into next 2023-02-18 15:43:04 +01:00
dma-iommu.c Merge branch 'iommu-memory-accounting' into core 2023-01-25 11:54:58 +01:00
dma-iommu.h iommu/dma: Make header private 2022-09-09 09:26:22 +02:00
exynos-iommu.c iommu/exynos: Fix set_platform_dma_ops() callback 2023-03-28 15:33:50 +02:00
fsl_pamu.c Merge branches 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 's390', 'x86/vt-d', 'x86/amd' and 'core' into next 2022-12-12 12:50:53 +01:00
fsl_pamu.h iommu/fsl_pamu: hardcode the window address and size in pamu_config_ppaace 2021-04-07 10:56:52 +02:00
fsl_pamu_domain.c iommu/fsl_pamu: Fix compile error after adding set_platform_dma_ops 2023-01-13 22:30:55 +01:00
fsl_pamu_domain.h iommu/fsl_pamu: remove the snoop_id field 2021-04-07 10:56:52 +02:00
hyperv-iommu.c iommu/hyper-v: Allow hyperv irq remapping without x2apic 2022-11-28 16:48:20 +00:00
io-pgfault.c iommu: Rename iommu-sva-lib.{c,h} 2022-11-03 15:47:54 +01:00
io-pgtable-arm-v7s.c iommu/io-pgtable-arm-v7s: Remove map/unmap 2022-11-19 10:44:15 +01:00
io-pgtable-arm.c iommu/io-pgtable-arm: Remove map/unmap 2022-11-19 10:44:15 +01:00
io-pgtable-arm.h iommu/io-pgtable-arm: Move some definitions to a header 2020-09-28 23:48:06 +01:00
io-pgtable-dart.c iommu/io-pgtable-dart: Add DART PTE support for t6000 2022-09-26 13:49:40 +02:00
io-pgtable.c Merge branches 'apple/dart', 'arm/mediatek', 'arm/omap', 'arm/smmu', 'virtio', 'x86/vt-d', 'x86/amd' and 'core' into next 2022-09-26 15:52:31 +02:00
ioasid.c iommu/sva: Assign a PASID to mm on PASID allocation and free it on mm exit 2022-02-15 11:31:35 +01:00
iommu-debugfs.c
…
iommu-sva.c iommu: Rename iommu-sva-lib.{c,h} 2022-11-03 15:47:54 +01:00
iommu-sva.h iommu: Rename iommu-sva-lib.{c,h} 2022-11-03 15:47:54 +01:00
iommu-sysfs.c
…
iommu-traces.c iommu: Remove detach_dev callback 2023-01-13 16:39:18 +01:00
iommu.c iommufd for 6.3 2023-02-24 14:34:12 -08:00
iova.c iommu/iova: Fix alloc iova overflows issue 2023-01-13 13:46:31 +01:00
ipmmu-vmsa.c iommu/ipmmu-vmsa: Remove ipmmu_utlb_disable() 2023-01-13 20:19:11 +01:00
irq_remapping.c x86: Kill all traces of irq_remapping_get_irq_domain() 2020-10-28 20:26:28 +01:00
irq_remapping.h x86: Kill all traces of irq_remapping_get_irq_domain() 2020-10-28 20:26:28 +01:00
msm_iommu.c iommu: Add set_platform_dma_ops callbacks 2023-01-13 16:39:16 +01:00
msm_iommu.h
…
msm_iommu_hw-8xxx.h
…
mtk_iommu.c iommu: Remove detach_dev callbacks 2023-01-13 16:39:14 +01:00
mtk_iommu_v1.c Merge branches 'apple/dart', 'arm/exynos', 'arm/renesas', 'arm/smmu', 'x86/vt-d', 'x86/amd' and 'core' into next 2023-02-18 15:43:04 +01:00
of_iommu.c iommu/of: mark an unused function as __maybe_unused 2023-02-16 10:17:31 +01:00
omap-iommu-debug.c iommu/omap: Fix buffer overflow in debugfs 2022-09-07 10:42:28 +02:00
omap-iommu.c iommu: Add set_platform_dma_ops callbacks 2023-01-13 16:39:16 +01:00
omap-iommu.h
…
omap-iopgtable.h
…
rockchip-iommu.c iommu: Remove detach_dev callbacks 2023-01-13 16:39:14 +01:00
s390-iommu.c iommufd for 6.3 2023-02-24 14:34:12 -08:00
sprd-iommu.c iommu: Remove detach_dev callbacks 2023-01-13 16:39:14 +01:00
sun50i-iommu.c iommu: Remove detach_dev callbacks 2023-01-13 16:39:14 +01:00
tegra-gart.c iommu: Add set_platform_dma_ops callbacks 2023-01-13 16:39:16 +01:00
tegra-smmu.c IOMMU Updates for Linux v6.3: 2023-02-24 13:40:13 -08:00
virtio-iommu.c iommu: Propagate return value in ->attach_dev callback functions 2022-11-01 14:39:59 -03:00