iommu: Fix attach handle publication ordering
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v3 Latest5 patches 1 replyIn review
- v25 patches 2 repliesSuperseded
- v14 patches 18 repliesSuperseded
Patches in v3 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | iommu: Unpublish the attach handle before the group detach callbackdrivers/ | +5 | 0 replies | |
| 2/5 | iommu: Unpublish the attach handle before the PASID detach callbackdrivers/ | +5 | 0 replies | |
| 3/5 | iommu: Unpublish the old attach handle before the group replace callbackdrivers/ | +13 | 0 replies | |
| 4/5 | iommu: Unpublish the old attach handle before the PASID replace callbackdrivers/ | +12 | 0 replies | |
| 5/5 | iommu: Reject a same-domain replace in the attach handle APIsdrivers/ | +29 | 1 reply |
Reviews trailers per patch
All 5 patches have a Reviewed-by or Acked-by.
| Patch | Kevin Tian | Yi Liu | Lu Baolu |
|---|---|---|---|
| 1/5 | R-b | R-b | R-b |
| 2/5 | R-b | R-b | R-b |
| 3/5 | R-b | R-b | R-b |
| 4/5 | R-b | R-b | R-b |
| 5/5 | R-b | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.
Cover letter [PATCH v3 0/5] iommu: Fix attach handle publication ordering
Jason pointed out an issue in the attach handle replacing path:
https://lore.kernel.org/linux-iommu/[email protected]/
When an attachment is detached or replaced, the IOMMU core can still leave the outgoing attach handle published while calling into the driver. A fault report looks up the handle without the group mutex, so it can find the old handle after the driver's fault flush and just before the caller frees it.
Patches 1-4 unpublish the outgoing handle before calling into the driver, for both group and PASID detach and replace operations. Both replace paths store XA_ZERO_ENTRY to reserve the slot and restore the old entry on error.
This blocks new lookups, but does not retire a fault that already obtained the old handle. The driver must still synchronize those readers before the handle is freed.
Patch 5 rejects a same-domain replace in both of the replace APIs. Such a replace skips the driver callback. So, nothing would ever flush the pending faults before the caller frees the old handle.
This is on GitHub:
https://github.com/nicolinc/iommufd/commits/fix_iommu_attach_handle-v3
Changelog
v3
* Add Reviewed-by from Yi
* Make the use-after-free hazard explicit in the same-domain comments
v2
https://lore.kernel.org/all/[email protected]/
* Rebase on v7.4-rc1
* Drop "Assisted-by: LLM" tags
* Add Reviewed-by from Kevin, Yi and Baolu
* New patch: reject a same-domain replace in the attach handle APIs
v1
https://lore.kernel.org/all/[email protected]/
Nicolin Chen (5):
iommu: Unpublish the attach handle before the group detach callback
iommu: Unpublish the attach handle before the PASID detach callback
iommu: Unpublish the old attach handle before the group replace
callback
iommu: Unpublish the old attach handle before the PASID replace
callback
iommu: Reject a same-domain replace in the attach handle APIs
drivers/iommu/iommu.c | 88 +++++++++++++++++++++++++++++++------------ 1 file changed, 63 insertions(+), 25 deletions(-)
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
Signature · 1 line
2.43.0