From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.nppct.ru (mail.nppct.ru [195.133.245.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AB9527C163 for ; Thu, 5 Jun 2025 20:19:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.133.245.4 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749154802; cv=none; b=UAljyksfr/QLf7ZidiDvRj7fDymBKtsf2TtXutc0r2qDVLJOfR2yYCERS7qbwfTH4ijCqgVWxfGdhKkFuwdyt3PsZSJRDodGgTHN6nLTwmGBMJFvGbO//mxChiMyVNUW+y6uqfWXnSiUfP4xw94nVPUWw+Y0Z9vEjB0IzrEbGlc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749154802; c=relaxed/simple; bh=TeGhnktdSvFxXreUkwhblyYxGqCrkCLuVr00TRFUiKg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fn3QHEy+YMMtmAbBfcyUIZj9yWcSrth6IRGYV7oXIoRJeeziddIwpDkWttkKUW/qYTejvZjvpCWR5b7EhIis/YTcP/dj9zvzUudFAVoXa6z/nWIbvvvOKdSlCM+Ko1JtIzkBiYOWZy6e62F/ENWPhQ/c/Nv1b5uRnp9ps36XIWE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=nppct.ru; spf=pass smtp.mailfrom=nppct.ru; dkim=pass (1024-bit key) header.d=nppct.ru header.i=@nppct.ru header.b=rm6yCB+o; arc=none smtp.client-ip=195.133.245.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=nppct.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nppct.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=nppct.ru header.i=@nppct.ru header.b="rm6yCB+o" Received: from mail.nppct.ru (localhost [127.0.0.1]) by mail.nppct.ru (Postfix) with ESMTP id 414F91C2ABD for ; Thu, 5 Jun 2025 23:19:57 +0300 (MSK) Authentication-Results: mail.nppct.ru (amavisd-new); dkim=pass (1024-bit key) reason="pass (just generated, assumed good)" header.d=nppct.ru DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nppct.ru; h= content-transfer-encoding:mime-version:references:in-reply-to :x-mailer:message-id:date:date:subject:subject:to:from:from; s= dkim; t=1749154796; x=1750018797; bh=TeGhnktdSvFxXreUkwhblyYxGqC rkCLuVr00TRFUiKg=; b=rm6yCB+o3Z3hQU5WzYf37ke60L1n2HbJe+h6EnbXih6 PUVbK5yUD2rjoHyBT10ycx8Dsm2hpwKQVrnM2cN1EOeeZIU+Pg8oPcT+lM3EK50R CQwPMc90Ia6mXLIqGX/ivzrwDEqwHV0Ee4xBHyAC6NyOtck6F0kieuB5yDM8I+cA = X-Virus-Scanned: Debian amavisd-new at mail.nppct.ru Received: from mail.nppct.ru ([127.0.0.1]) by mail.nppct.ru (mail.nppct.ru [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id lbEisGPpNHCD for ; Thu, 5 Jun 2025 23:19:56 +0300 (MSK) Received: from localhost.localdomain (unknown [87.249.24.51]) by mail.nppct.ru (Postfix) with ESMTPSA id 11A101C1151; Thu, 5 Jun 2025 23:19:48 +0300 (MSK) From: Alexey Nepomnyashih To: Lyude Paul Cc: Alexey Nepomnyashih , Danilo Krummrich , David Airlie , Simona Vetter , Maxime Coquelin , Alexandre Torgue , dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, stable@vger.kernel.org Subject: [PATCH v2 2/2] drm/nouveau/instmem/gk20a: fix incorrect argument in iommu_unmap Date: Thu, 5 Jun 2025 20:19:21 +0000 Message-ID: <20250605201927.339352-2-sdl@nppct.ru> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250605201927.339352-1-sdl@nppct.ru> References: <20250605201927.339352-1-sdl@nppct.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The unmap logic assumes a fixed step size of PAGE_SIZE, but the actual IOVA step depends on iommu_pgshift, not PAGE_SHIFT. If iommu_pgshift > PAGE_SHIFT, this results in mismatched offsets and causes iommu_unmap() to target incorrect addresses, potentially leaving mappings intact or corrupting IOMMU state. Fix this by recomputing the offset per index using the same logic as in the map loop, ensuring symmetry and correctness. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: stable@vger.kernel.org # v4.3+ Fixes: a7f6da6e758c ("drm/nouveau/instmem/gk20a: add IOMMU support") Signed-off-by: Alexey Nepomnyashih --- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c index 17a0e1a46211..f58e0d4fb2b1 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c @@ -481,8 +481,9 @@ gk20a_instobj_ctor_iommu(struct gk20a_instmem *imem, u32 npages, u32 align, nvkm_error(subdev, "IOMMU mapping failure: %d\n", ret); while (i-- > 0) { - offset -= PAGE_SIZE; - iommu_unmap(imem->domain, offset, PAGE_SIZE); + iommu_unmap(imem->domain, + ((unsigned long)r->offset + i) << imem->iommu_pgshift, + PAGE_SIZE); } goto release_area; } -- 2.43.0