From: Dmitry Safonov via iommu Subject: [RFC 0/3] iommu/iova: Unsafe locking in find_iova() Date: Thu, 21 Jun 2018 19:08:20 +0100 Message-ID: <20180621180823.805-1-dima@arista.com> Reply-To: Dmitry Safonov Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Dmitry Safonov <0x7f454c46-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>, David Woodhouse , iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Dmitry Safonov List-Id: iommu@lists.linux-foundation.org find_iova() looks to be using a bad locking practice: it locks the returned iova only for the search time. And looking in code, the element can be removed from the tree and freed under rbtree lock. That happens during memory hot-unplug and cleanup on module removal. Here I cleanup users of the function and delete it. Dmitry Safonov (3): iommu/iova: Find and split iova under rbtree's lock iommu/iova: Make free_iova() atomic iommu/iova: Remove find_iova() drivers/iommu/intel-iommu.c | 14 +++---------- drivers/iommu/iova.c | 48 +++++++++++++++++---------------------------- include/linux/iova.h | 17 ++++------------ 3 files changed, 25 insertions(+), 54 deletions(-) -- 2.13.6