Skip to contentSkip to conversation

FAILED: patch "[PATCH] iommufd: Fail replace if device has not been attached" failed to apply to 6.14-stable tree

PATCH [email protected] 2 participants 6 messages Apr 17, 2025

Subsystems (3)
Stable branch IOMMU Iommufd
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 55c85fa7579dc2e3f5399ef5bad67a44257c1a48
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025041759-knee-unearned-530e@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 55c85fa7579dc2e3f5399ef5bad67a44257c1a48 Mon Sep 17 00:00:00 2001
From: Yi Liu <[email protected]>
Date: Wed, 5 Mar 2025 19:48:42 -0800
Subject: [PATCH] iommufd: Fail replace if device has not been attached

The current implementation of iommufd_device_do_replace() implicitly assumes that the input device has already been attached. However, there is no explicit check to verify this assumption. If another device within the same group has been attached, the replace operation might succeed, but the input device itself may not have been attached yet.

As a result, the input device might not be tracked in the igroup->device_list, and its reserved IOVA might not be added. Despite this, the caller might incorrectly assume that the device has been successfully replaced, which could lead to unexpected behavior or errors.

To address this issue, add a check to ensure that the input device has been attached before proceeding with the replace operation. This check will help maintain the integrity of the device tracking system and prevent potential issues arising from incorrect assumptions about the device's attachment status.

Fixes e88d4ec154a8 ("iommufd: Add iommufd_device_replace()")
Link https://patch.msgid.link/r/[email protected] open here
Cc [email protected]
Reviewed-by Kevin Tian <[email protected]>
Signed-off-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +16 -0
index b2f0cb909e6d..bd50146e2ad0 100644
@@ -471,6 +471,17 @@ iommufd_device_attach_reserved_iova(struct iommufd_device *idev,
 
 /* The device attach/detach/replace helpers for attach_handle */
 
+/* Check if idev is attached to igroup->hwpt */
+static bool iommufd_device_is_attached(struct iommufd_device *idev)
+{
+	struct iommufd_device *cur;
+
+	list_for_each_entry(cur, &idev->igroup->device_list, group_item)
+		if (cur == idev)
+			return true;
+	return false;
+}
+
 static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
 				      struct iommufd_device *idev)
 {

@@ -710,6 +721,11 @@ iommufd_device_do_replace(struct iommufd_device *idev,
 		goto err_unlock;
 	}
 
+	if (!iommufd_device_is_attached(idev)) {
+		rc = -EINVAL;
+		goto err_unlock;
+	}
+
 	if (hwpt == igroup->hwpt) {
 		mutex_unlock(&idev->igroup->lock);
 		return NULL;
Reviewed-by
#1 lore raw
Quoted 8 lines · On 2025/4/17 19:42, [email protected] wrote:

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

Quoted 8 lines

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 55c85fa7579dc2e3f5399ef5bad67a44257c1a48
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025041759-knee-unearned-530e@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:

I think the possible dependency is the below commit. This patch adds a helper before iommufd_hwpt_attach_device() which is added by below commit.

commit fb21b1568adaa76af7a8c853f37c60fba8b28661

Author: Nicolin Chen <[email protected]>
Date:   Mon Feb 3 21:00:54 2025 -0800

iommufd: Make attach_handle generic than fault specific

"attach_handle" was added exclusively for the iommufd_fault_iopf_handler() used by IOPF/PRI use cases. Now, both the MSI and PASID series require to reuse the attach_handle for non-fault cases.

Add a set of new attach/detach/replace helpers that does the attach_handle allocation/releasing/replacement in the common path and also handles those fault specific routines such as iopf enabling/disabling and auto response.

This covers both non-fault and fault cases in a clean way, replacing those inline helpers in the header. The following patch will clean up those old helpers in the fault.c file.

Link:
https://patch.msgid.link/r/32687df01c02291d89986a9fca897bbbe2b10987.1738645017.git.nicolinc@nvidia.com

Signed-off-by Nicolin Chen <[email protected]>
Reviewed-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +9 -0
index dfd0898fb6c1..0786290b4056 100644
@@ -352,6 +352,111 @@ iommufd_device_attach_reserved_iova(struct iommufd_device *idev,
        return 0;
 }
 
+/* The device attach/detach/replace helpers for attach_handle */
+
+static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
+                                     struct iommufd_device *idev)
+{
+       struct iommufd_attach_handle *handle;
+       int rc;
+
+       lockdep_assert_held(&idev->igroup->lock);

@Greg, anything I need to do here?

Regards,
Yi Liu

Quoted 72 lines

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 55c85fa7579dc2e3f5399ef5bad67a44257c1a48 Mon Sep 17 00:00:00 2001
From: Yi Liu <[email protected]>
Date: Wed, 5 Mar 2025 19:48:42 -0800
Subject: [PATCH] iommufd: Fail replace if device has not been attached

The current implementation of iommufd_device_do_replace() implicitly assumes that the input device has already been attached. However, there is no explicit check to verify this assumption. If another device within the same group has been attached, the replace operation might succeed, but the input device itself may not have been attached yet.

As a result, the input device might not be tracked in the igroup->device_list, and its reserved IOVA might not be added. Despite this, the caller might incorrectly assume that the device has been successfully replaced, which could lead to unexpected behavior or errors.

To address this issue, add a check to ensure that the input device has been attached before proceeding with the replace operation. This check will help maintain the integrity of the device tracking system and prevent potential issues arising from incorrect assumptions about the device's attachment status.

Fixes e88d4ec154a8 ("iommufd: Add iommufd_device_replace()")
Link https://patch.msgid.link/r/[email protected] open here
Cc [email protected]
Reviewed-by Kevin Tian <[email protected]>
Signed-off-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +16 -0
index b2f0cb909e6d..bd50146e2ad0 100644
@@ -471,6 +471,17 @@ iommufd_device_attach_reserved_iova(struct iommufd_device *idev,
 
  /* The device attach/detach/replace helpers for attach_handle */
 
+/* Check if idev is attached to igroup->hwpt */
+static bool iommufd_device_is_attached(struct iommufd_device *idev)
+{
+	struct iommufd_device *cur;
+
+	list_for_each_entry(cur, &idev->igroup->device_list, group_item)
+		if (cur == idev)
+			return true;
+	return false;
+}
+
  static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
  				      struct iommufd_device *idev)
  {

@@ -710,6 +721,11 @@ iommufd_device_do_replace(struct iommufd_device *idev,
  		goto err_unlock;
  	}
 
+	if (!iommufd_device_is_attached(idev)) {
+		rc = -EINVAL;
+		goto err_unlock;
+	}
+
  	if (hwpt == igroup->hwpt) {
  		mutex_unlock(&idev->igroup->lock);
  		return NULL;
Signature · 2 lines
Regards,
Yi Liu
author maintainer
#2 lore raw
Quoted 64 lines · Yi Liu
Quoted 8 lines · On 2025/4/17 19:42, [email protected] wrote:

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

Quoted 8 lines

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 55c85fa7579dc2e3f5399ef5bad67a44257c1a48
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025041759-knee-unearned-530e@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:

I think the possible dependency is the below commit. This patch adds a helper before iommufd_hwpt_attach_device() which is added by below commit.

commit fb21b1568adaa76af7a8c853f37c60fba8b28661

Author: Nicolin Chen <[email protected]>
Date:   Mon Feb 3 21:00:54 2025 -0800

iommufd: Make attach_handle generic than fault specific

"attach_handle" was added exclusively for the iommufd_fault_iopf_handler() used by IOPF/PRI use cases. Now, both the MSI and PASID series require to reuse the attach_handle for non-fault cases.

Add a set of new attach/detach/replace helpers that does the attach_handle allocation/releasing/replacement in the common path and also handles those fault specific routines such as iopf enabling/disabling and auto response.

This covers both non-fault and fault cases in a clean way, replacing those inline helpers in the header. The following patch will clean up those old helpers in the fault.c file.

Link https://patch.msgid.link/r/32687df01c02291d89986a9fca897bbbe2b10987.1738645017.git.nicolinc@nvidia.com open here
Signed-off-by Nicolin Chen <[email protected]>
Reviewed-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +9 -0
index dfd0898fb6c1..0786290b4056 100644
@@ -352,6 +352,111 @@ iommufd_device_attach_reserved_iova(struct
 iommufd_device *idev,
        return 0;
 }
 
+/* The device attach/detach/replace helpers for attach_handle */
+
+static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
+                                     struct iommufd_device *idev)
+{
+       struct iommufd_attach_handle *handle;
+       int rc;
+
+       lockdep_assert_held(&idev->igroup->lock);
Quoted 1 line

@Greg, anything I need to do here?

That should be it, thanks!

greg k-h

#3 lore raw
Quoted 65 lines · Greg KH
Quoted 64 lines · Yi Liu
Quoted 8 lines · On 2025/4/17 19:42, [email protected] wrote:

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

Quoted 8 lines

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 55c85fa7579dc2e3f5399ef5bad67a44257c1a48
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025041759-knee-unearned-530e@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:

I think the possible dependency is the below commit. This patch adds a helper before iommufd_hwpt_attach_device() which is added by below commit.

commit fb21b1568adaa76af7a8c853f37c60fba8b28661

Author: Nicolin Chen <[email protected]>
Date:   Mon Feb 3 21:00:54 2025 -0800

iommufd: Make attach_handle generic than fault specific

"attach_handle" was added exclusively for the iommufd_fault_iopf_handler() used by IOPF/PRI use cases. Now, both the MSI and PASID series require to reuse the attach_handle for non-fault cases.

Add a set of new attach/detach/replace helpers that does the attach_handle allocation/releasing/replacement in the common path and also handles those fault specific routines such as iopf enabling/disabling and auto response.

This covers both non-fault and fault cases in a clean way, replacing those inline helpers in the header. The following patch will clean up those old helpers in the fault.c file.

Link https://patch.msgid.link/r/32687df01c02291d89986a9fca897bbbe2b10987.1738645017.git.nicolinc@nvidia.com open here
Signed-off-by Nicolin Chen <[email protected]>
Reviewed-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +9 -0
index dfd0898fb6c1..0786290b4056 100644
@@ -352,6 +352,111 @@ iommufd_device_attach_reserved_iova(struct
 iommufd_device *idev,
         return 0;
  }
 
+/* The device attach/detach/replace helpers for attach_handle */
+
+static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
+                                     struct iommufd_device *idev)
+{
+       struct iommufd_attach_handle *handle;
+       int rc;
+
+       lockdep_assert_held(&idev->igroup->lock);
Quoted 4 lines
Quoted 1 line

@Greg, anything I need to do here?

That should be it, thanks!

you are welcome. For 6.6, it might be difficult to apply all dependencies. I've posted a patch based on 6.6. Please let me know if it is not preferred.

Signature · 2 lines
Regards,
Yi Liu
author maintainer
#4 lore raw
Quoted 66 lines · Yi Liu
Quoted 65 lines · Greg KH
Quoted 64 lines · Yi Liu
Quoted 8 lines · On 2025/4/17 19:42, [email protected] wrote:

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

Quoted 8 lines

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 55c85fa7579dc2e3f5399ef5bad67a44257c1a48
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025041759-knee-unearned-530e@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:

I think the possible dependency is the below commit. This patch adds a helper before iommufd_hwpt_attach_device() which is added by below commit.

commit fb21b1568adaa76af7a8c853f37c60fba8b28661

Author: Nicolin Chen <[email protected]>
Date:   Mon Feb 3 21:00:54 2025 -0800

iommufd: Make attach_handle generic than fault specific

"attach_handle" was added exclusively for the iommufd_fault_iopf_handler() used by IOPF/PRI use cases. Now, both the MSI and PASID series require to reuse the attach_handle for non-fault cases.

Add a set of new attach/detach/replace helpers that does the attach_handle allocation/releasing/replacement in the common path and also handles those fault specific routines such as iopf enabling/disabling and auto response.

This covers both non-fault and fault cases in a clean way, replacing those inline helpers in the header. The following patch will clean up those old helpers in the fault.c file.

Link https://patch.msgid.link/r/32687df01c02291d89986a9fca897bbbe2b10987.1738645017.git.nicolinc@nvidia.com open here
Signed-off-by Nicolin Chen <[email protected]>
Reviewed-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +9 -0
index dfd0898fb6c1..0786290b4056 100644
@@ -352,6 +352,111 @@ iommufd_device_attach_reserved_iova(struct
 iommufd_device *idev,
         return 0;
  }
 
+/* The device attach/detach/replace helpers for attach_handle */
+
+static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
+                                     struct iommufd_device *idev)
+{
+       struct iommufd_attach_handle *handle;
+       int rc;
+
+       lockdep_assert_held(&idev->igroup->lock);
Quoted 8 lines
Quoted 4 lines
Quoted 1 line

@Greg, anything I need to do here?

That should be it, thanks!

you are welcome. For 6.6, it might be difficult to apply all dependencies. I've posted a patch based on 6.6. Please let me know if it is not preferred.

You forgot the git id in that commit :(

I fixed it up and took it now, thanks.

greg k-h

#5 lore raw
Quoted 73 lines · Greg KH
Quoted 72 lines · Yi Liu
Quoted 69 lines · Greg KH
Quoted 64 lines · Yi Liu
Quoted 8 lines · On 2025/4/17 19:42, [email protected] wrote:

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

Quoted 8 lines

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 55c85fa7579dc2e3f5399ef5bad67a44257c1a48
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025041759-knee-unearned-530e@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:

I think the possible dependency is the below commit. This patch adds a helper before iommufd_hwpt_attach_device() which is added by below commit.

commit fb21b1568adaa76af7a8c853f37c60fba8b28661

Author: Nicolin Chen <[email protected]>
Date:   Mon Feb 3 21:00:54 2025 -0800

iommufd: Make attach_handle generic than fault specific

"attach_handle" was added exclusively for the iommufd_fault_iopf_handler() used by IOPF/PRI use cases. Now, both the MSI and PASID series require to reuse the attach_handle for non-fault cases.

Add a set of new attach/detach/replace helpers that does the attach_handle allocation/releasing/replacement in the common path and also handles those fault specific routines such as iopf enabling/disabling and auto response.

This covers both non-fault and fault cases in a clean way, replacing those inline helpers in the header. The following patch will clean up those old helpers in the fault.c file.

Link https://patch.msgid.link/r/32687df01c02291d89986a9fca897bbbe2b10987.1738645017.git.nicolinc@nvidia.com open here
Signed-off-by Nicolin Chen <[email protected]>
Reviewed-by Yi Liu <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/iommu/iommufd/device.c +9 -0
index dfd0898fb6c1..0786290b4056 100644
@@ -352,6 +352,111 @@ iommufd_device_attach_reserved_iova(struct
 iommufd_device *idev,
          return 0;
   }
 
+/* The device attach/detach/replace helpers for attach_handle */
+
+static int iommufd_hwpt_attach_device(struct iommufd_hw_pagetable *hwpt,
+                                     struct iommufd_device *idev)
+{
+       struct iommufd_attach_handle *handle;
+       int rc;
+
+       lockdep_assert_held(&idev->igroup->lock);
Quoted 1 line

@Greg, anything I need to do here?

That should be it, thanks!

Quoted 6 lines
Quoted 2 lines

you are welcome. For 6.6, it might be difficult to apply all dependencies. I've posted a patch based on 6.6. Please let me know if it is not preferred.

You forgot the git id in that commit :(

I fixed it up and took it now, thanks.

oops, yes. I missed it. Thanks. Let me be careful next time. :)

Signature · 2 lines
Regards,
Yi Liu