From patchwork Thu Feb 22 21:23:45 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolin Chen X-Patchwork-Id: 205068 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp218187dyb; Thu, 22 Feb 2024 13:24:58 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCU6LUDigN6OFjEvab5ZHsclRelgCjTBnirBNPMnzpDUI0iIXZPrcXfDO0YrrFqudwDmW0ZWtSAC9fe6qBUOpUpCy4sEKQ== X-Google-Smtp-Source: AGHT+IFPIpj9hE6DLPHFZan4LLKLdwMTEeGYSrzgfYOGicE0WiNGmudmZOHlEL1+BKGBVZD8a1HS X-Received: by 2002:a2e:2a43:0:b0:2d2:4315:4d84 with SMTP id q64-20020a2e2a43000000b002d243154d84mr142655ljq.6.1708637098467; Thu, 22 Feb 2024 13:24:58 -0800 (PST) Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [2604:1380:4601:e00::3]) by mx.google.com with ESMTPS id a18-20020a05640213d200b005645fd10ad4si4639881edx.478.2024.02.22.13.24.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Feb 2024 13:24:58 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-77393-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3; Authentication-Results: mx.google.com; dkim=pass header.i=@Nvidia.com header.s=selector2 header.b="McFYw/77"; arc=fail (signature failed); spf=pass (google.com: domain of linux-kernel+bounces-77393-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-77393-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=nvidia.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id DF43B1F26B64 for ; Thu, 22 Feb 2024 21:24:57 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9B9CC137923; Thu, 22 Feb 2024 21:24:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="McFYw/77" Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2047.outbound.protection.outlook.com [40.107.220.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2BBB73F35; Thu, 22 Feb 2024 21:24:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.220.47 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708637048; cv=fail; b=cBwAeOW26OJWuI8IOkPx7ly/uRT1Py1hvtpLwfzcrqGqBmM+ZF0o8i8MK8FXkV/p/CDWRzDsMWZ+quGqfpls2lCMnH2VFTbf+mRFgPcnPeMhXXWtJMPSpJJbLhO1I9tmFd8Vp9AsaxadXi+3Qo1eV8OMMi/z2Dzzrc+AAl6Bt08= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708637048; c=relaxed/simple; bh=D8bCjACiAr3gyIL13jZY5k17i/XuVagx8K0yf/jCNxI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=S1Mr51B/V/iknOL74HwnqmBulKCJams6VEORoL4uV441Y1UhcAvYkpX1jUJP3I4fRrydwggBJFEa/TNL8BOG3LI/94Y7O4menhBMEDP44eb+cpPLn49BkZu2vH4QdspbzmjfY+q/cBi1R4I4RyW8THwMJI3GNvfJJVeAud5NSzI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=McFYw/77; arc=fail smtp.client-ip=40.107.220.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ITVgaiNJDDdaftPbPySrunCdtfA3Ss6MDbZ88/lnnaVPktxgbwFPiMYhhyl+qT4wN9KZulQ10Ga4PHg2dOoyDr7YTSSfvYArkLO+nwqcKQU35KdB8r36LiqM+1WxrZSQE6g3tNqRdF5PiWF+JNUmud3VehnayT2h7fI+oSVRcK3vrSmrev3chxu2+DqwA2OslP56AQwAPtXnNGRP9lDinxZF02LtOkjw4txGaJdmb0tSAke995nfKI6TQrWRAN2FWQv4zIKlYouDOiQojtT13Pm89Nz5vgGBz7bwZ+ECdx6Z0wFp1a+g4l/xdYZ5o0jbd8MV8D7Eh1qMd58WNMQSew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ORtLZL5Ga6nP2AjaBmDDZ/vU6ZMnsORJC3gdvFr6NOs=; b=HGLvVgUOQ71H3CdREkwvSFNXEj6ySz3xFBL1NsMscBB5d7OONT8sKX7x/q7yvaTeS5k9+VLOb66GlAyqqItkWQ4QME+1X80EK0JXC4ztuGZMFjEIaIfCbt+2n0qEVNTiW71fBQpSr/oOYUzVw7+a5gtyfbMCxZyJvBfG3eQUi4+/59E8ThDPy/EZWP9YfeGokeHIR4hy2fZMBLMZnYrKeFAHOrFgV6eTwFfcoqF5DEMGkMoPwQiU3cS6c9wrND/8JD8RpTbDqsPa1acR++scWjqZYD5n4u1YCzZ2o77cN2OhgqkyLYEtxqyNjuE37k7P+GgcmaXbYAzMrlW9YaCa5w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ORtLZL5Ga6nP2AjaBmDDZ/vU6ZMnsORJC3gdvFr6NOs=; b=McFYw/77T7+m9qZLhac58G99fFCUw6UMaiNu9EV8ZSlWzcbdbFSvYbvN6JZpQm5rNrN5P+YsQ1Rb70vIVAC5Xsok7ogCqblEDKHhd3nvf+5Ig0ZG9TbegTI0+Bts9o7eZzRQBOCa11COki5eNsfIsc/FL0dJdincNyotcRQdBAg629q4+y47XUKiBEgqGAZQpEpCpjC2z540Pn/MrdWk1TSj04Eww/ITZ2/Nny7CxymrMNua60jBAXVCjG/7BLnWU0xPrCjT2YMYz+4GKOlNVDB8deTia4itIzvJi1tbhezgeHdloj0PCLrzATKrTYE0LAhlFJj5ab7QXM4tkeSZUQ== Received: from DS7P222CA0027.NAMP222.PROD.OUTLOOK.COM (2603:10b6:8:2e::35) by DM6PR12MB4546.namprd12.prod.outlook.com (2603:10b6:5:2ae::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7316.24; Thu, 22 Feb 2024 21:24:02 +0000 Received: from DS2PEPF00003443.namprd04.prod.outlook.com (2603:10b6:8:2e:cafe::11) by DS7P222CA0027.outlook.office365.com (2603:10b6:8:2e::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.43 via Frontend Transport; Thu, 22 Feb 2024 21:24:01 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by DS2PEPF00003443.mail.protection.outlook.com (10.167.17.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.25 via Frontend Transport; Thu, 22 Feb 2024 21:24:00 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Thu, 22 Feb 2024 13:23:50 -0800 Received: from drhqmail202.nvidia.com (10.126.190.181) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.12; Thu, 22 Feb 2024 13:23:50 -0800 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.181) with Microsoft SMTP Server id 15.2.1258.12 via Frontend Transport; Thu, 22 Feb 2024 13:23:49 -0800 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH rc 1/3] iommufd: Fix iopt_access_list_id overwrite bug Date: Thu, 22 Feb 2024 13:23:45 -0800 Message-ID: <2dda7acb25b8562ec5f1310de828ef5da9ef509c.1708636627.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS2PEPF00003443:EE_|DM6PR12MB4546:EE_ X-MS-Office365-Filtering-Correlation-Id: 465afc7a-ad59-453e-cd9d-08dc33ec9690 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 5KDBc9bQQg7HEE9DcMbZb5/T76QmS2p/zChWMH15d7096V1GoDlWP/UWdvj5RkjKQpmFJE97wDUN/Rz7JlkT4lqEzOUL4iYOoSBm1Tc2ZTXBtn6KytA6ZXxrB1mcayxfCG/OODR+nCLL5ueBwJsg1nhJ9BOEP1CmhjP/smU6vTm90U1nN22zxOC0x94XNis2rNqpIupcS+mMAxMlmwMk+3QR+aZ3NazkQx0K3iMzl6ZS31vNh5TihNNGduo7dq/fOPDfZN9b6xGtU6Mh+OfktESK518opwH1ALVzcyo9hjPz4v2nb6NaGJ8Un7kH131NivFHsd3q1eTuHqT4IhsxZSJSwBWV78L7c4I7GW/XN4jvlO2LiX8hAtzHqgUSLMR5XCh4PdRnmQmgwrpJ9xV+MStOQ2b1hSF2DyKO3x80nd/N+8v7H1cBpFh/yE4SJQWJv3TwXXhCEAYqDHb3UVa0apnxpCiBzy9XJgyEIYTu5zkqsi3h1iU7Au9A5JIfi9vg3tSZLwc+SJ+0JKGiF3XO0GEPNhc9YUKvUGjzjhmwlbN9W14kpBrueVAWGABLy+3E2klUuiuCSbS60rK8JAgNFy8gQJpv6Fiw6bWBT5QE2C+V9BjkkYntfVdUHHeulf4RZTiY9nOtYFpBRNDum0XhrQ== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230031)(230273577357003)(36860700004)(40470700004)(46966006);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2024 21:24:00.9732 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 465afc7a-ad59-453e-cd9d-08dc33ec9690 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DS2PEPF00003443.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4546 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1791635853903732055 X-GMAIL-MSGID: 1791635853903732055 Jason has been running Syzkaller that reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 that is a bug of mismatched access pointers. Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 The mismatch between the access pointer in the list and the passed-in pointer is resulted from an overwrite at access->iopt_access_list_id, in iopt_add_access(), called from iommufd_access_change_ioas(), when xa_alloc() succeeds while iopt_calculate_iova_alignment() fails. Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully. Fixes: 9227da7816dd ("iommufd: Add iommufd_access_change_ioas(_id) helpers") Cc: stable@vger.kernel.org Reported-by: Jason Gunthorpe Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen --- drivers/iommu/iommufd/io_pagetable.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c index 504ac1b01b2d..05fd9d3abf1b 100644 --- a/drivers/iommu/iommufd/io_pagetable.c +++ b/drivers/iommu/iommufd/io_pagetable.c @@ -1330,20 +1330,23 @@ int iopt_disable_large_pages(struct io_pagetable *iopt) int iopt_add_access(struct io_pagetable *iopt, struct iommufd_access *access) { + u32 new_id; int rc; down_write(&iopt->domains_rwsem); down_write(&iopt->iova_rwsem); - rc = xa_alloc(&iopt->access_list, &access->iopt_access_list_id, access, - xa_limit_16b, GFP_KERNEL_ACCOUNT); + rc = xa_alloc(&iopt->access_list, &new_id, access, xa_limit_16b, + GFP_KERNEL_ACCOUNT); + if (rc) goto out_unlock; rc = iopt_calculate_iova_alignment(iopt); if (rc) { - xa_erase(&iopt->access_list, access->iopt_access_list_id); + xa_erase(&iopt->access_list, new_id); goto out_unlock; } + access->iopt_access_list_id = new_id; out_unlock: up_write(&iopt->iova_rwsem); From patchwork Thu Feb 22 21:23:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolin Chen X-Patchwork-Id: 205069 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp218206dyb; Thu, 22 Feb 2024 13:25:01 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCVhBI835EGkrO1fxxQxcOW4HNz5J4lcmP3Y1hHqtYPQXC4FNqJMgV9F/wTb1VTPJIuItiEJyCzCt+bX3i+sbFL4M9BIfQ== X-Google-Smtp-Source: AGHT+IH9ZZXfQ6N1u+TItRYd+NenuVUnVMiNOIg2Rkiicqu7ctDMOHHTOiTfjD3C/GO/uvdDBiYQ X-Received: by 2002:ac8:584b:0:b0:42e:4a39:2c23 with SMTP id h11-20020ac8584b000000b0042e4a392c23mr324409qth.23.1708637100003; Thu, 22 Feb 2024 13:25:00 -0800 (PST) Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [147.75.199.223]) by mx.google.com with ESMTPS id g14-20020ac85d4e000000b0042c39f13dc1si14803259qtx.377.2024.02.22.13.24.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Feb 2024 13:24:59 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-77394-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223; Authentication-Results: mx.google.com; dkim=pass header.i=@Nvidia.com header.s=selector2 header.b=JP0Zkfhw; arc=fail (signature failed); spf=pass (google.com: domain of linux-kernel+bounces-77394-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-77394-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=nvidia.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id B736D1C24765 for ; Thu, 22 Feb 2024 21:24:59 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E372D137929; Thu, 22 Feb 2024 21:24:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="JP0Zkfhw" Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2052.outbound.protection.outlook.com [40.107.93.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2BC873F34; Thu, 22 Feb 2024 21:24:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.93.52 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708637048; cv=fail; b=IglMgbrFW8WhLk1n5GUZ5uoFrf1GDAteiGHhKfMKannij4WEbHOQlRqIcxmiMx3jF8ezZipzrCGGUFZYqPIvsBlnvQ2v1goJDeR1wQiAhphSpxVR+aQCHpoeDw+WCxCGQqKzvkAg5lq75J1l7hjzZ+gE7tY33au96zF/yYcKst8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708637048; c=relaxed/simple; bh=7gYb/Pa7F+IchcPJNpoDmvFaA7AMFCi/jgZyJuMVPwQ=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=hq4i2Gd94fNcfWWSDuobCC778OoIkOzLU8UIGEKeJmPuLsgWzxmCxgjMIu4/JKzmzk0OGEeWrMWkQFYgoQDNQP9RcrGbzyKdPqAuqXOuDi2O+A0l50G1RyL7f75rLAPJ2oCzFT1qULL5+sYnKy+Ke8wHU/Le2tJfmAtiFYtXGaY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=JP0Zkfhw; arc=fail smtp.client-ip=40.107.93.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IxckmzUV6okaYIWjIf5OqGx5ILoxW68QF9amqsDqv8cpur5b9PURopVclu0F+2cQ2u08S2NmrAUWLgFd93DQCxrRhIg9qMmTi/YBUr37mcQBG4s/HGRB9qkIT7fndbz0/f1z8VLyYrVBobfD7O5kEGI8DA2L/H3h24HDxJYo+TOqwnssJLxQrfN4SgACGo9j9PInNqxiWSamTaK2phBNAQS/h+oKdLjcL0VbINAr2qlNH1/p9OX23P74oDcQngFuOyXfMon+HXC4YwMvaBQbTd+lqTdXGpSscBnKf/saT38/kiYM+UUlAmvz17EC7e/fnm468yvZN2ZucmEZtbnIjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LNjD251+po3w/LiQLxpp7IMemVrG4UuyMR7gGkw2Xmo=; b=lXZXJMmQGypAhR+aSL5YanJDkiVStU0tFH0/m7VYcpKFFU4MmBlqY2kldWMb8GrxlVA54yWjI4wtzZCt4XLK32NQAkDeT7rIk4/hT6bVdSiQ6HaplWG7QnKRFO6ouFx+5jyi+lnNhPuWvTljT02gNLVuezMq37ZhJDrm5/jPAmkbNG88EYbAV0fVKlswwJK0JvrNNUuc8D/Jdo/oISv0nTs8bN/Wxz1Cez3eoRxb35koNLJU8JstehisWbotGXHuHwu2wVqcs7SjUSx9d24bs8a21wAs9bgndxYaFpmGY2jZWKpydRr1/UiJLXE/VGOKVj5q2ahHWMGHZwLEyTbzmw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LNjD251+po3w/LiQLxpp7IMemVrG4UuyMR7gGkw2Xmo=; b=JP0ZkfhwGjQ0EexCBcyMINq1YczHlNcjUQfIwbJ8gT3kClhYVYsfTR08kn0IqGTb6TqIzOgb4ja3tDygApGg+5wtXmYwbRBJm3WbrvQXuVZJu6C/JhAlySrWvl2PkNOG+jtNgxnEZrGfYsjtHCWVhLg6qt4LrdK0i6PVLZ9+4lbDu2H55grRo3eC65TQbH1bYOogP66rYdz+I5ccfp+vNGgZ4/IBFxrjMaeQkl+25akksYqBcgt7aJvnmzYWoMhhUdz/Ec+2Namqhp0Ip93yWeXQZVZ9C9XL8RFIdauCGIBYUc6lACVr++0ujso6rNWvcCrGo9Nfdvx7t+OSVwus8A== Received: from BN9PR03CA0150.namprd03.prod.outlook.com (2603:10b6:408:fe::35) by IA1PR12MB7734.namprd12.prod.outlook.com (2603:10b6:208:422::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7316.26; Thu, 22 Feb 2024 21:24:03 +0000 Received: from BN3PEPF0000B06A.namprd21.prod.outlook.com (2603:10b6:408:fe:cafe::63) by BN9PR03CA0150.outlook.office365.com (2603:10b6:408:fe::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.43 via Frontend Transport; Thu, 22 Feb 2024 21:24:03 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by BN3PEPF0000B06A.mail.protection.outlook.com (10.167.243.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.0 via Frontend Transport; Thu, 22 Feb 2024 21:24:03 +0000 Received: from drhqmail202.nvidia.com (10.126.190.181) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Thu, 22 Feb 2024 13:23:51 -0800 Received: from drhqmail202.nvidia.com (10.126.190.181) by drhqmail202.nvidia.com (10.126.190.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.12; Thu, 22 Feb 2024 13:23:50 -0800 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.181) with Microsoft SMTP Server id 15.2.1258.12 via Frontend Transport; Thu, 22 Feb 2024 13:23:50 -0800 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH rc 2/3] iommufd/selftest: Fix mock_dev_num bug Date: Thu, 22 Feb 2024 13:23:46 -0800 Message-ID: <5af41d5af6d5c013cc51de01427abb8141b3587e.1708636627.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN3PEPF0000B06A:EE_|IA1PR12MB7734:EE_ X-MS-Office365-Filtering-Correlation-Id: 2c5be1af-520d-48c8-d335-08dc33ec980a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 2izBziPcK759nCqVpsZTG/RBVLfcS7j1gqTfZlgv0v0xaqGtGjFXZl6Asykdp5BACQWuJP6odRcPygp8Z8wvf3FPxKCTec6J3Kc/Vkx5Ntwn0AFKkUvnhOyLwOIoULKwwc/DwkT45elewEVxFLNuUqr/58NjO1Gyd99HTiNvMiz2nBLmZkeaOYecnAxfl6QRldV0bBr+ZPK7ogNgBW+Za3+4RBNsXSCcNNEs0BAY5w9fMHBNIqEnpIDcQrNak+sXN6M4K5O+3oURHnowjDB3f0EsgdRqrZ9YRplsAvgl3814cusHvnixdprs3BIy0UxaIs/KtuMZ37ULBl4QtctcdFgzITdbpwO//XkaJbc+U/6uUwfBTYXkSlaaduMf6Mi/ESGybMbdq7OcedjkG92TqdOsyrEuYXgu0DRfUE4AwUeRo/cTmI034Axj842XQwT6engOj4chPpgXmoLJeLGG4qMUmLlpeFA26nzlaNZIXJPXsVSc5bSP4e87o6+DC5ZdUgTncWDg8YyiWes8tuIe4RIWL0Pj+RlNrcjJl9bP/l4l6bun6gCghRXNw2N0YWt034nn4UOBpQsratJHOwgo1iavZutrCdNO4QIPnXql5dOdSs6aYYsFP8RMprv1nSkZXiOp1lWlFUUiKZ92NuUW3/Wpv6i92IBDXunnl7AEIpk= X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230031)(36860700004)(40470700004)(46966006);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2024 21:24:03.4037 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2c5be1af-520d-48c8-d335-08dc33ec980a X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN3PEPF0000B06A.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR12MB7734 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1791635855345385013 X-GMAIL-MSGID: 1791635855345385013 Jason has been running Syzkaller that reported the following bug: sysfs: cannot create duplicate filename '/devices/iommufd_mock4' Call Trace: sysfs_warn_dup+0x71/0x90 sysfs_create_dir_ns+0x1ee/0x260 ? sysfs_create_mount_point+0x80/0x80 ? spin_bug+0x1d0/0x1d0 ? do_raw_spin_unlock+0x54/0x220 kobject_add_internal+0x221/0x970 kobject_add+0x11c/0x1e0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ? kset_create_and_add+0x160/0x160 ? kobject_put+0x5d/0x390 ? bus_get_dev_root+0x4a/0x60 ? kobject_put+0x5d/0x390 device_add+0x1d5/0x1550 ? __fw_devlink_link_to_consumers.isra.0+0x1f0/0x1f0 ? __init_waitqueue_head+0xcb/0x150 iommufd_test+0x462/0x3b60 ? lock_release+0x1fe/0x640 ? __might_fault+0x117/0x170 ? reacquire_held_locks+0x4b0/0x4b0 ? iommufd_selftest_destroy+0xd0/0xd0 ? __might_fault+0xbe/0x170 iommufd_fops_ioctl+0x256/0x350 ? iommufd_option+0x180/0x180 ? __lock_acquire+0x1755/0x45f0 __x64_sys_ioctl+0xa13/0x1640 The bug is triggered when Syzkaller created multiple mock devices but didn't destroy them in the same sequence, messing up the mock_dev_num counter. So, fix it with a mock_dev_ida. Fixes: 23a1b46f15d5 ("iommufd/selftest: Make the mock iommu driver into a real driver") Cc: stable@vger.kernel.org Reported-by: Jason Gunthorpe Signed-off-by: Nicolin Chen --- drivers/iommu/iommufd/selftest.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c index 8abf9747773e..2bfe77bd351d 100644 --- a/drivers/iommu/iommufd/selftest.c +++ b/drivers/iommu/iommufd/selftest.c @@ -36,7 +36,7 @@ static struct mock_bus_type iommufd_mock_bus_type = { }, }; -static atomic_t mock_dev_num; +static DEFINE_IDA(mock_dev_ida); enum { MOCK_DIRTY_TRACK = 1, @@ -123,6 +123,7 @@ enum selftest_obj_type { struct mock_dev { struct device dev; unsigned long flags; + int id; }; struct selftest_obj { @@ -631,7 +632,7 @@ static void mock_dev_release(struct device *dev) { struct mock_dev *mdev = container_of(dev, struct mock_dev, dev); - atomic_dec(&mock_dev_num); + ida_free(&mock_dev_ida, mdev->id); kfree(mdev); } @@ -653,8 +654,12 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags) mdev->dev.release = mock_dev_release; mdev->dev.bus = &iommufd_mock_bus_type.bus; - rc = dev_set_name(&mdev->dev, "iommufd_mock%u", - atomic_inc_return(&mock_dev_num)); + rc = ida_alloc(&mock_dev_ida, GFP_KERNEL); + if (rc < 0) + goto err_put; + mdev->id = rc; + + rc = dev_set_name(&mdev->dev, "iommufd_mock%u", mdev->id); if (rc) goto err_put; From patchwork Thu Feb 22 21:23:47 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolin Chen X-Patchwork-Id: 205071 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp218306dyb; Thu, 22 Feb 2024 13:25:15 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCVnxeHyX8vFrjCQb3AHZqonh5AawXereOC3y2VbpuyIS33KBiRl1RAt7aGWA8vDL+/899jQercS3pRF0A7VAjtjYyI44w== X-Google-Smtp-Source: AGHT+IGEpI0S4JG9lQjQd5lO83b7dQBG/kjVFifu7LVTCdCFyoVR19fsIv1b1WQJ4jxhrlNuFnJ2 X-Received: by 2002:a17:906:e0c8:b0:a3c:f016:22a4 with SMTP id gl8-20020a170906e0c800b00a3cf01622a4mr33003ejb.37.1708637114967; Thu, 22 Feb 2024 13:25:14 -0800 (PST) Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [2604:1380:4601:e00::3]) by mx.google.com with ESMTPS id a23-20020a170906191700b00a3eac92955csi3610399eje.668.2024.02.22.13.25.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Feb 2024 13:25:14 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-77395-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3; Authentication-Results: mx.google.com; dkim=pass header.i=@Nvidia.com header.s=selector2 header.b=tEuxKpka; arc=fail (signature failed); spf=pass (google.com: domain of linux-kernel+bounces-77395-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-kernel+bounces-77395-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=nvidia.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id 6F6941F26941 for ; Thu, 22 Feb 2024 21:25:14 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D6A9A13BAC9; Thu, 22 Feb 2024 21:24:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="tEuxKpka" Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2074.outbound.protection.outlook.com [40.107.93.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0CF412D1F7; Thu, 22 Feb 2024 21:24:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.93.74 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708637050; cv=fail; b=WLaOexFS4e6ZSw3Gn2Egq0jPUuqBoIlMo6NwL8sV5kaS0IcCUeBqvwIFfCQZMA541v9hKWZ5pn0gEiXDuZNZlWfIjjA7/7I+O3W/1vmvRouHKV0QJs/cwsas+ydcqIC+P3AeVaxDHsD0xmMSve8IwnoJCUsfze3fhhcm8N9yEOM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708637050; c=relaxed/simple; bh=nxuqavFmUafOV6nwxMr7abbtQryf0eGGYq17hFLNDCk=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=gKTfduv/76LFnEtXEqm1mZH5YJwOsX+vnLkAYEayOczGx6toYYUl+D1H2PNLVNGPKnd+NtpTmcloXffwqT5q2V74No+VSf04fZAfgJKulyU3NNeK1FLgkK5S75XMc1vwUHR+HKev4/7PS0X62gDZpstt6zNrdsIffUPVdd7NApQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=tEuxKpka; arc=fail smtp.client-ip=40.107.93.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jMCyPh4GvuzawHSEliSoexW0STIQcNVyuvrg4WUcRpfz+V7VOhFflGIhL5tqoR8tYEEIv4yWQsfL6MnCN/gEIqirBiEyOirYiL5qffRLxuZtcVDjAD8pSfQQWK1IQfV4Mx9p5z8ltM/GN8QPoxGjcg1IBusbkfQvKu//tZxCamo1YjO7Wn0rdk5m0CgvUQQKbJKZ5LpVhw7cBH8xfh46TFlk2gVbS7CPBrOP+nKD9K8tWSCcRw4+EUq59j2KK3ClRe4jFeA8gsPEEekmq0v/I3vNbSEfOFF22Gtuy0cNghdmAjA7ifwYlk6tCtucWVrzQVQeT+qy7jeX6BOaECDiHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=nqVQ5ptS5EIYcKnMPZL8+89QjJAIM06thQdPpK2WrR8=; b=EdfelgKvbOC+I45+4TzMoj8kA4dIModWNP5Cw3iJKNLtEoXXcMcQ4dYbvbPNhMCBSSJCWqkyln8MbXPU1eZFoaO0h+Iy2fOcPV0t8iwMkjUIJBHDCqemXzG3hl3ZeYuvc8C6rgPzWclMHzIOBg2NFGF2iFUe+QN3y3psx0kpvmav104r4F6xlWsRGN2FLG3Szw2hQ9OkFuB//evzGkbIVpRIp+ETKEVm87NwGy7NPRHiaeFuE5dIx6YmjFgbvsZIq24nFlXIz9BaQfZMC9fYC4yzXvxPxG4Ob4qbwumgZwxiqeQgy3Yz9VfgUOlm5uVdLvG+9MqZ6kTrrrsADxvfAw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=intel.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nqVQ5ptS5EIYcKnMPZL8+89QjJAIM06thQdPpK2WrR8=; b=tEuxKpkae12Z3uUUg1Vd7oeFiJT+Zt5VxOApVPRzVvfiBNo+AFvk11dCk81vflQ032+r9vFnPNd4UgYmYkcXw290qpD+rOop52ia8ajCN5VAUaME1TqQ+oXJ8RNJSMbiutmuP1Bams0jFE1KlNzwZA4dPZd2Iz5mIKRskuCVmdtpa7pRblw3sZ8eoeAPoLKkBTdj6WU5q5QTa7cIXoAuXtHGQ/ucMwraFqBQaj71Sogx67+zhuBGWwBG/gmg/cU8yKvMUI8UHnLzgHlm/OYr4ROxrV8mAm7a4AA6G9iwIOJmGcQhAA0qEVoJOZTClizoBkhKuTiTmZDt1wNT3es49Q== Received: from DS7P222CA0026.NAMP222.PROD.OUTLOOK.COM (2603:10b6:8:2e::32) by DS0PR12MB8786.namprd12.prod.outlook.com (2603:10b6:8:149::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7316.20; Thu, 22 Feb 2024 21:24:05 +0000 Received: from DS2PEPF00003443.namprd04.prod.outlook.com (2603:10b6:8:2e:cafe::e3) by DS7P222CA0026.outlook.office365.com (2603:10b6:8:2e::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.43 via Frontend Transport; Thu, 22 Feb 2024 21:24:05 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by DS2PEPF00003443.mail.protection.outlook.com (10.167.17.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.25 via Frontend Transport; Thu, 22 Feb 2024 21:24:05 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Thu, 22 Feb 2024 13:23:52 -0800 Received: from drhqmail202.nvidia.com (10.126.190.181) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.12; Thu, 22 Feb 2024 13:23:51 -0800 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.181) with Microsoft SMTP Server id 15.2.1258.12 via Frontend Transport; Thu, 22 Feb 2024 13:23:51 -0800 From: Nicolin Chen To: , CC: , , , , Subject: [PATCH rc 3/3] iommufd: Fix protection fault in iommufd_test_syz_conv_iova Date: Thu, 22 Feb 2024 13:23:47 -0800 Message-ID: <3f1932acaf1dd494d404c04364d73ce8f57f3e5e.1708636627.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS2PEPF00003443:EE_|DS0PR12MB8786:EE_ X-MS-Office365-Filtering-Correlation-Id: 1f5ae20d-19ac-4a97-2423-08dc33ec9931 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: zRz20f8/JTBjxNvBq9QuYJD96SyOQuqCiXf3avTlv6xPgKStMhZpjq6CSp8SKlse2j1q/xWy5kS/zlGqdUhF01v7ttHwWqMtpWMZh1loaWyoVOFCo/1MilBRqR9BiJG6Su9ZMHT7gIici77tyw/BHqD1brXHLpFvHB2XMor/u0arPKHBONAxytAk+phLbSbs0YbnN8urChsrYKIGwhCq+aBiwFzFSskJc7P0iEY5bHPOVFIoWBeGMwZVTlaByPz4NMNr0PwRn6WIXmUfkWvT5Yn7sLmvWINnGydZSAX3vkD+H0O3SZjQjWLa5Zo/q8KVKYyqsuw7EvE0CaOlBAahu4zDJW/3Aj7zdOoAYasOQ24A8A9xVWRXkV6EVgokltKmDcS+RHboQGD7sLu+EwDOouk+BibWiKK8OfIjmMb5K26vF+y4vpiymUx8Dm1cJ41sZRXpIS0kaDudovCGR08XSCFfyJPySL+flGE9hI8q1RYzjPHPfRIngc3kSJIRSaP/lRXumhGQknRi1pU5rUTZ/dQ7pdm1m3eT4L1CjIVPOOInkvWAdiOjc6XtEtn+OHj+x1kLdX2PGhtOYoECtkEZxStqSSA6EdPbymwYYwXPVUfDZVTsQX4p2ltQT4axX7PRM5qokREk1EIzZtd1ofFTAQ== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230031)(36860700004)(40470700004)(46966006);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2024 21:24:05.3794 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1f5ae20d-19ac-4a97-2423-08dc33ec9931 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DS2PEPF00003443.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB8786 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1791635871751752986 X-GMAIL-MSGID: 1791635871751752986 Jason has been running Syzkaller that reported the following bug: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140 This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context. Fix this by doing the same access->ioas sanity as iommufd_access_rw and iommufd_access_pin_pages functions do. Fixes: 9227da7816dd ("iommufd: Add iommufd_access_change_ioas(_id) helpers") Cc: stable@vger.kernel.org Reported-by: Jason Gunthorpe Signed-off-by: Nicolin Chen --- drivers/iommu/iommufd/selftest.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c index 2bfe77bd351d..d59e199a8705 100644 --- a/drivers/iommu/iommufd/selftest.c +++ b/drivers/iommu/iommufd/selftest.c @@ -63,8 +63,8 @@ enum { * In syzkaller mode the 64 bit IOVA is converted into an nth area and offset * value. This has a much smaller randomization space and syzkaller can hit it. */ -static unsigned long iommufd_test_syz_conv_iova(struct io_pagetable *iopt, - u64 *iova) +static unsigned long __iommufd_test_syz_conv_iova(struct io_pagetable *iopt, + u64 *iova) { struct syz_layout { __u32 nth_area; @@ -88,6 +88,21 @@ static unsigned long iommufd_test_syz_conv_iova(struct io_pagetable *iopt, return 0; } +static unsigned long iommufd_test_syz_conv_iova(struct iommufd_access *access, + u64 *iova) +{ + unsigned long ret; + + mutex_lock(&access->ioas_lock); + if (!access->ioas) { + mutex_unlock(&access->ioas_lock); + return 0; + } + ret = __iommufd_test_syz_conv_iova(&access->ioas->iopt, iova); + mutex_unlock(&access->ioas_lock); + return ret; +} + void iommufd_test_syz_conv_iova_id(struct iommufd_ucmd *ucmd, unsigned int ioas_id, u64 *iova, u32 *flags) { @@ -100,7 +115,7 @@ void iommufd_test_syz_conv_iova_id(struct iommufd_ucmd *ucmd, ioas = iommufd_get_ioas(ucmd->ictx, ioas_id); if (IS_ERR(ioas)) return; - *iova = iommufd_test_syz_conv_iova(&ioas->iopt, iova); + *iova = __iommufd_test_syz_conv_iova(&ioas->iopt, iova); iommufd_put_object(ucmd->ictx, &ioas->obj); } @@ -1161,7 +1176,7 @@ static int iommufd_test_access_pages(struct iommufd_ucmd *ucmd, } if (flags & MOCK_FLAGS_ACCESS_SYZ) - iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt, + iova = iommufd_test_syz_conv_iova(staccess->access, &cmd->access_pages.iova); npages = (ALIGN(iova + length, PAGE_SIZE) - @@ -1263,8 +1278,8 @@ static int iommufd_test_access_rw(struct iommufd_ucmd *ucmd, } if (flags & MOCK_FLAGS_ACCESS_SYZ) - iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt, - &cmd->access_rw.iova); + iova = iommufd_test_syz_conv_iova(staccess->access, + &cmd->access_rw.iova); rc = iommufd_access_rw(staccess->access, iova, tmp, length, flags); if (rc)