From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751113AbcGNKg5 (ORCPT ); Thu, 14 Jul 2016 06:36:57 -0400 Received: from foss.arm.com ([217.140.101.70]:41860 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750862AbcGNKg4 (ORCPT ); Thu, 14 Jul 2016 06:36:56 -0400 Subject: Re: [PATCH] iommu/iova: validate iova_domain input to put_iova_domain To: Joerg Roedel , Nate Watterson References: <1468435772-27905-1-git-send-email-nwatters@codeaurora.org> <20160714083420.GR12639@8bytes.org> Cc: iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org From: Robin Murphy Message-ID: <57876B45.6010206@arm.com> Date: Thu, 14 Jul 2016 11:36:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 In-Reply-To: <20160714083420.GR12639@8bytes.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 14/07/16 09:34, Joerg Roedel wrote: > On Wed, Jul 13, 2016 at 02:49:32PM -0400, Nate Watterson wrote: >> Passing a NULL or uninitialized iova_domain into put_iova_domain >> will currently crash the kernel when the unconfigured iova_domain >> data members are accessed. To prevent this from occurring, this patch >> adds a check to make sure that the domain is non-NULL and that the >> domain granule is non-zero. The granule can be used to check if the >> domain was properly initialized because calling init_iova_domain >> with a granule of zero would have already triggered a BUG statement >> crashing the kernel. > > Have you seen real crashes happening because of this? It _can_ happen via the iommu-dma code if something goes wrong initialising a group - the IOVA domain gets allocated at the same time as the default IOMMU domain, but isn't initialised until later once the device in question gets ity dma ops set up. If adding the device to the group fails, everything gets torn down again and iommu_put_dma_cookie() ends up trying to take an uninitialised lock . However, I think the appropriate fix for that particular situation would be more like this: diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index ea5a9ebf0f78..d00d22930a6b 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -65,10 +65,11 @@ void iommu_put_dma_cookie(struct iommu_domain *domain) { struct iova_domain *iovad = domain->iova_cookie; - if (!iovad) + if (domain->type != IOMMU_DOMAIN_DMA || !iovad) return; - put_iova_domain(iovad); + if (iovad->granule) + put_iova_domain(iovad); kfree(iovad); domain->iova_cookie = NULL; } (It probably should have been that way from the start; mea culpa) Robin.