mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/iommu
History
Jason Gunthorpe b7c822fa6b iommufd: Set end correctly when doing batch carry 
Even though the test suite covers this it somehow became obscured that
this wasn't working.

The test iommufd_ioas.mock_domain.access_domain_destory would blow up
rarely.

end should be set to 1 because this just pushed an item, the carry, to the
pfns list.

Sometimes the test would blow up with:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP
  CPU: 5 PID: 584 Comm: iommufd Not tainted 6.5.0-rc1-dirty #1236
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  RIP: 0010:batch_unpin+0xa2/0x100 [iommufd]
  Code: 17 48 81 fe ff ff 07 00 77 70 48 8b 15 b7 be 97 e2 48 85 d2 74 14 48 8b 14 fa 48 85 d2 74 0b 40 0f b6 f6 48 c1 e6 04 48 01 f2 <48> 8b 3a 48 c1 e0 06 89 ca 48 89 de 48 83 e7 f0 48 01 c7 e8 96 dc
  RSP: 0018:ffffc90001677a58 EFLAGS: 00010246
  RAX: 00007f7e2646f000 RBX: 0000000000000000 RCX: 0000000000000001
  RDX: 0000000000000000 RSI: 00000000fefc4c8d RDI: 0000000000fefc4c
  RBP: ffffc90001677a80 R08: 0000000000000048 R09: 0000000000000200
  R10: 0000000000030b98 R11: ffffffff81f3bb40 R12: 0000000000000001
  R13: ffff888101f75800 R14: ffffc90001677ad0 R15: 00000000000001fe
  FS:  00007f9323679740(0000) GS:ffff8881ba540000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 0000000105ede003 CR4: 00000000003706a0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   <TASK>
   ? show_regs+0x5c/0x70
   ? __die+0x1f/0x60
   ? page_fault_oops+0x15d/0x440
   ? lock_release+0xbc/0x240
   ? exc_page_fault+0x4a4/0x970
   ? asm_exc_page_fault+0x27/0x30
   ? batch_unpin+0xa2/0x100 [iommufd]
   ? batch_unpin+0xba/0x100 [iommufd]
   __iopt_area_unfill_domain+0x198/0x430 [iommufd]
   ? __mutex_lock+0x8c/0xb80
   ? __mutex_lock+0x6aa/0xb80
   ? xa_erase+0x28/0x30
   ? iopt_table_remove_domain+0x162/0x320 [iommufd]
   ? lock_release+0xbc/0x240
   iopt_area_unfill_domain+0xd/0x10 [iommufd]
   iopt_table_remove_domain+0x195/0x320 [iommufd]
   iommufd_hw_pagetable_destroy+0xb3/0x110 [iommufd]
   iommufd_object_destroy_user+0x8e/0xf0 [iommufd]
   iommufd_device_detach+0xc5/0x140 [iommufd]
   iommufd_selftest_destroy+0x1f/0x70 [iommufd]
   iommufd_object_destroy_user+0x8e/0xf0 [iommufd]
   iommufd_destroy+0x3a/0x50 [iommufd]
   iommufd_fops_ioctl+0xfb/0x170 [iommufd]
   __x64_sys_ioctl+0x40d/0x9a0
   do_syscall_64+0x3c/0x80
   entry_SYSCALL_64_after_hwframe+0x46/0xb0

Link: https://lore.kernel.org/r/3-v1-85aacb2af554+bc-iommufd_syz3_jgg@nvidia.com
Cc: <stable@vger.kernel.org>
Fixes: f394576eb1 ("iommufd: PFN handling for iopt_pages")
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Reported-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
 		2023-07-27 11:27:20 -03:00
..
amd IOMMU Updates for Linux v6.5 2023-06-29 20:51:03 -07:00
arm Merge branches 'iommu/fixes', 'arm/smmu', 'ppc/pamu', 'virtio', 'x86/vt-d', 'core' and 'x86/amd' into next 2023-06-19 10:12:42 +02:00
intel IOMMU Updates for Linux v6.5 2023-06-29 20:51:03 -07:00
iommufd iommufd: Set end correctly when doing batch carry 2023-07-27 11:27:20 -03:00
Kconfig - Yosry Ahmed brought back some cgroup v1 stats in OOM logs. 2023-06-28 10:28:11 -07:00
Makefile iommu: Remove ioasid infrastructure 2023-03-31 10:03:31 +02:00
apple-dart.c iommu/apple-dart: Convert to platform remove callback returning void 2023-03-31 10:01:55 +02:00
dma-iommu.c IOMMU Updates for Linux v6.5 2023-06-29 20:51:03 -07:00
dma-iommu.h iommu/dma: Make header private 2022-09-09 09:26:22 +02:00
exynos-iommu.c Merge branches 'iommu/fixes', 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/omap', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 'unisoc', 'x86/vt-d', 'x86/amd', 'core' and 'platform-remove_new' into next 2023-04-14 13:45:50 +02:00
fsl_pamu.c iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c 2023-03-22 14:50:15 +01:00
fsl_pamu.h
…
fsl_pamu_domain.c iommu/fsl: Use driver_managed_dma to allow VFIO to work 2023-06-01 11:47:48 +02:00
fsl_pamu_domain.h
…
hyperv-iommu.c iommu/hyper-v: Allow hyperv irq remapping without x2apic 2022-11-28 16:48:20 +00:00
io-pgfault.c iommu: Rename iommu-sva-lib.{c,h} 2022-11-03 15:47:54 +01:00
io-pgtable-arm-v7s.c iommu/io-pgtable-arm-v7s: Remove map/unmap 2022-11-19 10:44:15 +01:00
io-pgtable-arm.c iommu/io-pgtable-arm: Remove map/unmap 2022-11-19 10:44:15 +01:00
io-pgtable-arm.h
…
io-pgtable-dart.c iommu/io-pgtable-dart: Add DART PTE support for t6000 2022-09-26 13:49:40 +02:00
io-pgtable.c Merge branches 'apple/dart', 'arm/mediatek', 'arm/omap', 'arm/smmu', 'virtio', 'x86/vt-d', 'x86/amd' and 'core' into next 2022-09-26 15:52:31 +02:00
iommu-debugfs.c
…
iommu-sva.c iommu/sva: Fix signedness bug in iommu_sva_alloc_pasid() 2023-07-14 14:53:19 +02:00
iommu-sva.h iommu: Remove ioasid infrastructure 2023-03-31 10:03:31 +02:00
iommu-sysfs.c
…
iommu-traces.c iommu: Remove detach_dev callback 2023-01-13 16:39:18 +01:00
iommu.c iommu: Fix crash during syfs iommu_groups/N/type 2023-07-14 14:49:33 +02:00
iova.c iommu/iova: Optimize iova_magazine_alloc() 2023-05-22 17:09:51 +02:00
ipmmu-vmsa.c Merge branches 'iommu/fixes', 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/omap', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 'unisoc', 'x86/vt-d', 'x86/amd', 'core' and 'platform-remove_new' into next 2023-04-14 13:45:50 +02:00
irq_remapping.c
…
irq_remapping.h
…
msm_iommu.c iommu/msm: Convert to platform remove callback returning void 2023-03-31 10:01:57 +02:00
msm_iommu.h
…
msm_iommu_hw-8xxx.h
…
mtk_iommu.c iommu/mediatek: Flush IOTLB completely only if domain has been attached 2023-06-01 11:50:13 +02:00
mtk_iommu_v1.c iommu/mtk_iommu_v1: Convert to platform remove callback returning void 2023-03-31 10:01:58 +02:00
of_iommu.c iommu/of: mark an unused function as __maybe_unused 2023-02-16 10:17:31 +01:00
omap-iommu-debug.c iommu/omap: Fix buffer overflow in debugfs 2022-09-07 10:42:28 +02:00
omap-iommu.c Merge branches 'iommu/fixes', 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/omap', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 'unisoc', 'x86/vt-d', 'x86/amd', 'core' and 'platform-remove_new' into next 2023-04-14 13:45:50 +02:00
omap-iommu.h
…
omap-iopgtable.h
…
rockchip-iommu.c iommu/rockchip: Fix unwind goto issue 2023-05-22 17:03:08 +02:00
s390-iommu.c iommufd for 6.3 2023-02-24 14:34:12 -08:00
sprd-iommu.c Merge branches 'iommu/fixes', 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/omap', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 'unisoc', 'x86/vt-d', 'x86/amd', 'core' and 'platform-remove_new' into next 2023-04-14 13:45:50 +02:00
sun50i-iommu.c iommu/sun50i: remove MODULE_LICENSE in non-modules 2023-04-13 13:13:52 -07:00
tegra-gart.c iommu: Add set_platform_dma_ops callbacks 2023-01-13 16:39:16 +01:00
tegra-smmu.c IOMMU Updates for Linux v6.3: 2023-02-24 13:40:13 -08:00
virtio-iommu.c iommu/virtio: Return size mapped for a detached domain 2023-05-23 08:19:03 +02:00