From patchwork Fri Nov 4 19:51:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Robin Murphy X-Patchwork-Id: 15766 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp606910wru; Fri, 4 Nov 2022 12:56:30 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7jQYzVjny0z9tKtM24EvwzaExXnUuDCHyMSef1YmwdIL9S0YMce8FZIAgQTW1do+69rqRt X-Received: by 2002:a05:6402:5250:b0:461:e870:850f with SMTP id t16-20020a056402525000b00461e870850fmr37334376edd.404.1667591790345; Fri, 04 Nov 2022 12:56:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667591790; cv=none; d=google.com; s=arc-20160816; b=0eiZJx0b9qX8LP91yIOopdbLTwMYaElxJ3m0K/F9cjv/72g6My2IJnYOYQwb8lqHPg GFLJ+xDBWJJggLC/vHSbfhf2tfGwTjBvHjecGLH0zGY47DneHjbsbEHDq/Qkr2+gopba 5snsgR+C1rpbf+4sDusunbROkfzmuZ/Kg3qQDGcC3R5Lix9jxwqqj7cV589+j2NBRJIR JjsnRWQ58VtSeitPzPHPpweKizk9Ev1qMsJy1bnj18oYvBL7JzZedbbWzJD5X0Q324zD g94ibsHUcx0HO+LbLH9FZk/2ZjmS389+jMRdeaVXvm/Fr6gNAzn9GEMBLxXxmUBG/Pu6 sW6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=8/5J71t22vhEdmefpMXO6Rv4MzeBHysEEndXC6cfr50=; b=cRO5nO1s5Ocit1yEP/OZy5lwqEvgzWOhgBtyoHGhHVXnj6XByINIfy0neBnN46gwuC 3USX2MMk26dOdlCyPhX8oO2N2adf5UXPkLOAUa9OwIDGzwd4nzNL711TAM4ePxMw3fJu xtaAdSREZs4wInx1uL1FRAh8V/iImwzHQHRtaZMWHBSTOesfICqvIH9W2GjQjyXqUdJA UY2V2w4uZ5ddOUiMQwm1B5gz23seFa/SL/kZZXUlQtpsujCuhWz1g/sK67fEeFnIdmPJ rPnkMGk4K9VYhbWT6+Jjuyb/UQ8Xu7y5vNRV2SYqfo10RRbnlV9PahspC4jVwzGnJxmZ meNQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=arm.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id gn13-20020a1709070d0d00b0078c4a772ea7si4280553ejc.11.2022.11.04.12.56.06; Fri, 04 Nov 2022 12:56:30 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=arm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229533AbiKDTvy (ORCPT + 99 others); Fri, 4 Nov 2022 15:51:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229532AbiKDTvv (ORCPT ); Fri, 4 Nov 2022 15:51:51 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 7F9D22CDC0 for ; Fri, 4 Nov 2022 12:51:50 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4A0371FB; Fri, 4 Nov 2022 12:51:56 -0700 (PDT) Received: from e121345-lin.cambridge.arm.com (e121345-lin.cambridge.arm.com [10.1.196.40]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 216DD3F5A1; Fri, 4 Nov 2022 12:51:48 -0700 (PDT) From: Robin Murphy To: joro@8bytes.org Cc: will@kernel.org, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Brian Norris Subject: [PATCH] iommu: Avoid races around device probe Date: Fri, 4 Nov 2022 19:51:43 +0000 Message-Id: <1946ef9f774851732eed78760a78ec40dbc6d178.1667591503.git.robin.murphy@arm.com> X-Mailer: git-send-email 2.36.1.dirty MIME-Version: 1.0 X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748596729281215350?= X-GMAIL-MSGID: =?utf-8?q?1748596729281215350?= We currently have 3 different ways that __iommu_probe_device() may be called, but no real guarantee that multiple callers can't tread on each other, especially once asynchronous driver probe gets involved. It would likely have taken a fair bit of luck to hit this previously, but commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") ups the odds since now it's not just omap-iommu that may trigger multiple bus_iommu_probe() calls in parallel if probing asynchronously. Add a lock to ensure we can't try to double-probe a device, and also close some possible race windows to make sure we're truly robust against trying to double-initialise a group via two different member devices. Reported-by: Brian Norris Signed-off-by: Robin Murphy Tested-by: Brian Norris --- drivers/iommu/iommu.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 65a3b3d886dc..959d895fc1df 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -283,13 +283,23 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list const struct iommu_ops *ops = dev->bus->iommu_ops; struct iommu_device *iommu_dev; struct iommu_group *group; + static DEFINE_MUTEX(iommu_probe_device_lock); int ret; if (!ops) return -ENODEV; - - if (!dev_iommu_get(dev)) - return -ENOMEM; + /* + * Serialise to avoid races between IOMMU drivers registering in + * parallel and/or the "replay" calls from ACPI/OF code via client + * driver probe. Once the latter have been cleaned up we should + * probably be able to use device_lock() here to minimise the scope, + * but for now enforcing a simple global ordering is fine. + */ + mutex_lock(&iommu_probe_device_lock); + if (!dev_iommu_get(dev)) { + ret = -ENOMEM; + goto err_unlock; + } if (!try_module_get(ops->owner)) { ret = -EINVAL; @@ -309,11 +319,14 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list ret = PTR_ERR(group); goto out_release; } - iommu_group_put(group); + mutex_lock(&group->mutex); if (group_list && !group->default_domain && list_empty(&group->entry)) list_add_tail(&group->entry, group_list); + mutex_unlock(&group->mutex); + iommu_group_put(group); + mutex_unlock(&iommu_probe_device_lock); iommu_device_link(iommu_dev, dev); return 0; @@ -328,6 +341,9 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list err_free: dev_iommu_free(dev); +err_unlock: + mutex_unlock(&iommu_probe_device_lock); + return ret; } @@ -1799,11 +1815,11 @@ int bus_iommu_probe(struct bus_type *bus) return ret; list_for_each_entry_safe(group, next, &group_list, entry) { + mutex_lock(&group->mutex); + /* Remove item from the list */ list_del_init(&group->entry); - mutex_lock(&group->mutex); - /* Try to allocate default domain */ probe_alloc_default_domain(bus, group);