From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 166C539A07E for ; Fri, 12 Jun 2026 18:26:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781288806; cv=none; b=SLAHqYkf8dAm3aMmtgLwpbHW3xHlAs8SZQqPZGOxUG8iP3sO2V84g9tkWs6BQDLouB1iLMx8T3+kDZQbbLvVlJWn96yZCzLolvORllXk5IZjoRN3VWAykRTCBXOj5mKII/KjZ+qh3SveeE7LfMzVV7jVWSikNZ+l5zwBVBFBd5w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781288806; c=relaxed/simple; bh=DoBx+L1S23hfZwFwEdZN/BPrjzFn9OnhsiZ8glz2qH8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=QAkhyRxnb26zY/fxpsmywXyHTo8yJ4GBaySyeRKysDAzdQoeScz9FkgN/F76GPmdqh+oMbgNjiS955zpyPfUFSBrDQO3hzOQPoGHrY0fq/4emUIB0q2n32YwFs4Y6/lp2WMO8hmNUj3OEM+7DKDXl3OGF9b8b2s89ojQfkGJgWc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bdTiR52D; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bdTiR52D" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53F781F000E9; Fri, 12 Jun 2026 18:26:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781288804; bh=fDvNS2WFK4zT+LRFpQO+de6OaZj5lw0a9i7V1PhdgMQ=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=bdTiR52DuAksKAiSdHyvyD/q9Igu6YRQagQcIYDKwtj2aCVuNmfCvqsb9K8ndsfYL KJmW3lbmjz4PYiA/oNRIlOVcRkcCiy7ILGXmWf75a4lOdpveo1UgAJcZMzS6PVXq71 xZMAKBmiyYb2F/trNjC6BNew8i6W9yB0XpPgkMitiOq2hMG8kIoj7x7sRTKtOfUgoY /IxFAdZhgjXo6Z++XGq1R6phb0ieJZ9ex8kZqlMUrlo0oQkS7TIF4uXzsWN8/Hc/Nv KRIslLwP4207Wmg7TMweiXS/Z5kw9s234ykVJ0JQoKzDAbYoBaWY2oivbHa/2EmaJ6 QXv6GlPOtv4Eg== Message-ID: <921fb98f-8737-4249-b07c-cafa2a4fdea0@kernel.org> Date: Fri, 12 Jun 2026 13:26:43 -0500 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH V3 3/3] accel/amdxdna: Fix iommu domain lifetime race during device removal Content-Language: en-US To: Lizhi Hou , ogabbay@kernel.org, quic_jhugo@quicinc.com, dri-devel@lists.freedesktop.org, karol.wachowski@linux.intel.com Cc: linux-kernel@vger.kernel.org, max.zhen@amd.com, sonal.santan@amd.com References: <20260611055150.3070216-1-lizhi.hou@amd.com> <20260611055150.3070216-3-lizhi.hou@amd.com> From: Mario Limonciello In-Reply-To: <20260611055150.3070216-3-lizhi.hou@amd.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 6/11/26 00:51, Lizhi Hou wrote: > When force_iova mode is enabled, amdxdna_remove() frees xdna->domain. If > amdxdna_gem_obj_free() is called after device removal, it may attempt to > access xdna->domain, resulting in a use-after-free. > > Fix the race by adding freeing xdna->domain as a managed release action, > so its lifetime is managed by DRM and remains valid until all managed > resources are released. > > Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter") > Signed-off-by: Lizhi Hou Reviewed-by: Mario Limonciello (AMD) > --- > drivers/accel/amdxdna/amdxdna_iommu.c | 43 ++++++++++++++++++--------- > 1 file changed, 29 insertions(+), 14 deletions(-) > > diff --git a/drivers/accel/amdxdna/amdxdna_iommu.c b/drivers/accel/amdxdna/amdxdna_iommu.c > index eff00131d0f8..4f245b969eef 100644 > --- a/drivers/accel/amdxdna/amdxdna_iommu.c > +++ b/drivers/accel/amdxdna/amdxdna_iommu.c > @@ -4,6 +4,7 @@ > */ > > #include > +#include > #include > #include > > @@ -153,10 +154,30 @@ void amdxdna_iommu_free(struct amdxdna_dev *xdna, size_t size, > free_pages((unsigned long)cpu_addr, get_order(size)); > } > > +static void amdxdna_cleanup_force_iova(struct drm_device *dev, void *res) > +{ > + struct amdxdna_dev *xdna = to_xdna_dev(dev); > + > + if (xdna->domain) { > + iommu_detach_group(xdna->domain, xdna->group); > + put_iova_domain(&xdna->iovad); > + iova_cache_put(); > + iommu_domain_free(xdna->domain); > + } > + > + iommu_group_put(xdna->group); > +} > + > +void amdxdna_iommu_fini(struct amdxdna_dev *xdna) > +{ > + if (xdna->group && !xdna->domain) > + iommu_group_put(xdna->group); > +} > + > int amdxdna_iommu_init(struct amdxdna_dev *xdna) > { > unsigned long order; > - int ret; > + int ret = 0; > > xdna->group = iommu_group_get(xdna->ddev.dev); > if (!xdna->group || !force_iova) > @@ -182,8 +203,14 @@ int amdxdna_iommu_init(struct amdxdna_dev *xdna) > if (ret) > goto put_iova; > > + ret = drmm_add_action(&xdna->ddev, amdxdna_cleanup_force_iova, NULL); > + if (ret) > + goto detach_group; > + > return 0; > > +detach_group: > + iommu_detach_group(xdna->domain, xdna->group); > put_iova: > put_iova_domain(&xdna->iovad); > iova_cache_put(); > @@ -191,20 +218,8 @@ int amdxdna_iommu_init(struct amdxdna_dev *xdna) > iommu_domain_free(xdna->domain); > put_group: > iommu_group_put(xdna->group); > + xdna->group = NULL; > xdna->domain = NULL; > > return ret; > } > - > -void amdxdna_iommu_fini(struct amdxdna_dev *xdna) > -{ > - if (xdna->domain) { > - iommu_detach_group(xdna->domain, xdna->group); > - put_iova_domain(&xdna->iovad); > - iova_cache_put(); > - iommu_domain_free(xdna->domain); > - } > - > - if (xdna->group) > - iommu_group_put(xdna->group); > -}