From: Hector Martin <marcan@marcan.st>
To: Jason Gunthorpe <jgg@nvidia.com>
Cc: acpica-devel@lists.linux.dev,
Alyssa Rosenzweig <alyssa@rosenzweig.io>,
Albert Ou <aou@eecs.berkeley.edu>,
asahi@lists.linux.dev, Catalin Marinas <catalin.marinas@arm.com>,
Dexuan Cui <decui@microsoft.com>,
devicetree@vger.kernel.org, David Woodhouse <dwmw2@infradead.org>,
Frank Rowand <frowand.list@gmail.com>,
Hanjun Guo <guohanjun@huawei.com>,
Haiyang Zhang <haiyangz@microsoft.com>,
iommu@lists.linux.dev,
Jean-Philippe Brucker <jean-philippe@linaro.org>,
Jonathan Hunter <jonathanh@nvidia.com>,
Joerg Roedel <joro@8bytes.org>,
"K. Y. Srinivasan" <kys@microsoft.com>,
Len Brown <lenb@kernel.org>,
linux-acpi@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-hyperv@vger.kernel.org, linux-mips@vger.kernel.org,
linux-riscv@lists.infradead.org,
linux-snps-arc@lists.infradead.org, linux-tegra@vger.kernel.org,
Russell King <linux@armlinux.org.uk>,
Lorenzo Pieralisi <lpieralisi@kernel.org>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Palmer Dabbelt <palmer@dabbelt.com>,
patches@lists.linux.dev, Paul Walmsley <paul.walmsley@sifive.com>,
"Rafael J. Wysocki" <rafael@kernel.org>,
Robert Moore <robert.moore@intel.com>,
Rob Herring <robh+dt@kernel.org>,
Robin Murphy <robin.murphy@arm.com>,
Sudeep Holla <sudeep.holla@arm.com>,
Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>,
Sven Peter <sven@svenpeter.dev>,
Thierry Reding <thierry.reding@gmail.com>,
Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
Krishna Reddy <vdumpa@nvidia.com>,
Vineet Gupta <vgupta@kernel.org>,
virtualization@lists.linux.dev, Wei Liu <wei.liu@kernel.org>,
Will Deacon <will@kernel.org>
Subject: Re: [PATCH v2 06/17] iommu: Add iommu_fwspec_alloc/dealloc()
Date: Thu, 23 Nov 2023 18:08:33 +0900 [thread overview]
Message-ID: <ab23469f-19ce-4681-afc9-65518730b51b@marcan.st> (raw)
In-Reply-To: <20231121160058.GG6083@nvidia.com>
On 2023/11/22 1:00, Jason Gunthorpe wrote:
> On Tue, Nov 21, 2023 at 03:47:48PM +0900, Hector Martin wrote:
>>> Which is sensitive only to !NULL fwspec, and if EPROBE_DEFER is
>>> returned fwspec will be freed and dev->iommu->fwspec will be NULL
>>> here.
>>>
>>> In the NULL case it does a 'bus probe' with a NULL fwspec and all the
>>> fwspec drivers return immediately from their probe functions.
>>>
>>> Did I miss something?
>>
>> apple_dart is not a fwspec driver and doesn't do that :-)
>
> It implements of_xlate that makes it a driver using the fwspec probe
> path.
>
> The issue is in apple-dart. Its logic for avoiding bus probe vs
> fwspec probe is not correct.
>
> It does:
>
> static int apple_dart_of_xlate(struct device *dev, struct of_phandle_args *args)
> {
> [..]
> dev_iommu_priv_set(dev, cfg);
>
>
> Then:
>
> static struct iommu_device *apple_dart_probe_device(struct device *dev)
> {
> struct apple_dart_master_cfg *cfg = dev_iommu_priv_get(dev);
> struct apple_dart_stream_map *stream_map;
> int i;
>
> if (!cfg)
> return ERR_PTR(-ENODEV);
>
> Which leaks the cfg memory on rare error cases and wrongly allows the
> driver to probe without a fwspec, which I think is what you are
> hitting.
>
> It should be
>
> if (!dev_iommu_fwspec_get(dev) || !cfg)
> return ERR_PTR(-ENODEV);
>
> To ensure the driver never probes on the bus path.
>
> Clearing the dev->iommu in the core code has the side effect of
> clearing (and leaking) the cfg which would hide this issue.
Aha! Yes, that makes it work with only the first change. I'll throw the
apple-dart fix into our tree (and submit it once I get to clearing out
the branch; the affected consumer driver isn't upstream yet so this
isn't particularly urgent).
- Hector
next prev parent reply other threads:[~2023-11-23 9:08 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-15 14:05 [PATCH v2 00/17] Solve iommu probe races around iommu_fwspec Jason Gunthorpe
2023-11-15 14:05 ` [PATCH v2 01/17] iommu: Remove struct iommu_ops *iommu from arch_setup_dma_ops() Jason Gunthorpe
2023-11-15 14:05 ` [PATCH v2 02/17] iommmu/of: Do not return struct iommu_ops from of_iommu_configure() Jason Gunthorpe
2023-11-15 14:05 ` [PATCH v2 03/17] iommu/of: Use -ENODEV consistently in of_iommu_configure() Jason Gunthorpe
2023-11-15 14:42 ` Jerry Snitselaar
2023-11-15 14:05 ` [PATCH v2 04/17] acpi: Do not return struct iommu_ops from acpi_iommu_configure_id() Jason Gunthorpe
2023-11-15 14:45 ` Jerry Snitselaar
2023-11-15 14:05 ` [PATCH v2 05/17] iommu: Make iommu_fwspec->ids a distinct allocation Jason Gunthorpe
2023-11-15 14:05 ` [PATCH v2 06/17] iommu: Add iommu_fwspec_alloc/dealloc() Jason Gunthorpe
2023-11-19 8:10 ` Hector Martin
2023-11-19 9:19 ` Hector Martin
2023-11-19 14:13 ` Jason Gunthorpe
2023-11-21 6:47 ` Hector Martin
2023-11-21 16:00 ` Jason Gunthorpe
2023-11-23 9:08 ` Hector Martin [this message]
2023-11-15 14:05 ` [PATCH v2 07/17] iommu: Add iommu_probe_device_fwspec() Jason Gunthorpe
2023-11-15 14:05 ` [PATCH v2 08/17] iommu/of: Do not use dev->iommu within of_iommu_configure() Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 09/17] iommu: Add iommu_fwspec_append_ids() Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 10/17] acpi: Do not use dev->iommu within acpi_iommu_configure() Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 11/17] iommu: Hold iommu_probe_device_lock while calling ops->of_xlate Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 12/17] iommu: Make iommu_ops_from_fwnode() static Jason Gunthorpe
2023-11-15 15:09 ` Jerry Snitselaar
2023-11-16 14:36 ` Moritz Fischer
2023-11-15 14:06 ` [PATCH v2 13/17] iommu: Remove dev_iommu_fwspec_set() Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 14/17] iommu: Remove pointless iommu_fwspec_free() Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 15/17] iommu: Add ops->of_xlate_fwspec() Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 16/17] iommu: Mark dev_iommu_get() with lockdep Jason Gunthorpe
2023-11-15 14:06 ` [PATCH v2 17/17] iommu: Mark dev_iommu_priv_set() with a lockdep Jason Gunthorpe
2023-11-15 14:54 ` [PATCH v2 00/17] Solve iommu probe races around iommu_fwspec Jerry Snitselaar
2023-11-15 15:22 ` Robin Murphy
2023-11-15 15:36 ` Jason Gunthorpe
2023-11-15 20:23 ` Robin Murphy
2023-11-16 4:17 ` Jason Gunthorpe
2023-11-21 16:06 ` Robin Murphy
2023-11-21 17:55 ` Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ab23469f-19ce-4681-afc9-65518730b51b@marcan.st \
--to=marcan@marcan.st \
--cc=acpica-devel@lists.linux.dev \
--cc=alyssa@rosenzweig.io \
--cc=aou@eecs.berkeley.edu \
--cc=asahi@lists.linux.dev \
--cc=catalin.marinas@arm.com \
--cc=decui@microsoft.com \
--cc=devicetree@vger.kernel.org \
--cc=dwmw2@infradead.org \
--cc=frowand.list@gmail.com \
--cc=guohanjun@huawei.com \
--cc=haiyangz@microsoft.com \
--cc=iommu@lists.linux.dev \
--cc=jean-philippe@linaro.org \
--cc=jgg@nvidia.com \
--cc=jonathanh@nvidia.com \
--cc=joro@8bytes.org \
--cc=kys@microsoft.com \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux-snps-arc@lists.infradead.org \
--cc=linux-tegra@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=lpieralisi@kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=palmer@dabbelt.com \
--cc=patches@lists.linux.dev \
--cc=paul.walmsley@sifive.com \
--cc=rafael@kernel.org \
--cc=robert.moore@intel.com \
--cc=robh+dt@kernel.org \
--cc=robin.murphy@arm.com \
--cc=sudeep.holla@arm.com \
--cc=suravee.suthikulpanit@amd.com \
--cc=sven@svenpeter.dev \
--cc=thierry.reding@gmail.com \
--cc=tsbogend@alpha.franken.de \
--cc=vdumpa@nvidia.com \
--cc=vgupta@kernel.org \
--cc=virtualization@lists.linux.dev \
--cc=wei.liu@kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).