From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jerry Snitselaar <jsnitsel@redhat.com>, Joerg Roedel <joro@8bytes.org>, Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>, Joerg Roedel <jroedel@suse.de>, Sasha Levin <sashal@kernel.org>, iommu@lists.linux-foundation.org Subject: [PATCH AUTOSEL 4.19 11/65] iommu/amd: Call free_iova_fast with pfn in map_sg Date: Sat, 23 Feb 2019 16:05:46 -0500 [thread overview] Message-ID: <20190223210640.200911-11-sashal@kernel.org> (raw) In-Reply-To: <20190223210640.200911-1-sashal@kernel.org> From: Jerry Snitselaar <jsnitsel@redhat.com> [ Upstream commit 51d8838d66d3249508940d8f59b07701f2129723 ] In the error path of map_sg, free_iova_fast is being called with address instead of the pfn. This results in a bad value getting into the rcache, and can result in hitting a BUG_ON when iova_magazine_free_pfns is called. Cc: Joerg Roedel <joro@8bytes.org> Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com> Fixes: 80187fd39dcb ("iommu/amd: Optimize map_sg and unmap_sg") Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index bee0dfb7b93b1..5edc8e6f27114 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -2554,7 +2554,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, } out_free_iova: - free_iova_fast(&dma_dom->iovad, address, npages); + free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages); out_err: return 0; -- 2.19.1
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> To: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Sasha Levin <sashal-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>, Joerg Roedel <jroedel-l3A5Bk7waGM@public.gmane.org>, iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Subject: [PATCH AUTOSEL 4.19 11/65] iommu/amd: Call free_iova_fast with pfn in map_sg Date: Sat, 23 Feb 2019 16:05:46 -0500 [thread overview] Message-ID: <20190223210640.200911-11-sashal@kernel.org> (raw) In-Reply-To: <20190223210640.200911-1-sashal-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> From: Jerry Snitselaar <jsnitsel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> [ Upstream commit 51d8838d66d3249508940d8f59b07701f2129723 ] In the error path of map_sg, free_iova_fast is being called with address instead of the pfn. This results in a bad value getting into the rcache, and can result in hitting a BUG_ON when iova_magazine_free_pfns is called. Cc: Joerg Roedel <joro-zLv9SwRftAIdnm+yROfE0A@public.gmane.org> Cc: Suravee Suthikulpanit <suravee.suthikulpanit-5C7GfCeVMHo@public.gmane.org> Signed-off-by: Jerry Snitselaar <jsnitsel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> Fixes: 80187fd39dcb ("iommu/amd: Optimize map_sg and unmap_sg") Signed-off-by: Joerg Roedel <jroedel-l3A5Bk7waGM@public.gmane.org> Signed-off-by: Sasha Levin <sashal-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> --- drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index bee0dfb7b93b1..5edc8e6f27114 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -2554,7 +2554,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, } out_free_iova: - free_iova_fast(&dma_dom->iovad, address, npages); + free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages); out_err: return 0; -- 2.19.1
next prev parent reply other threads:[~2019-02-23 21:27 UTC|newest] Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-02-23 21:05 [PATCH AUTOSEL 4.19 01/65] vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 02/65] xfrm: refine validation of template and selector families Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 03/65] xfrm: Make set-mark default behavior backward compatible Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 04/65] netfilter: nft_compat: use refcnt_t type for nft_xt reference count Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 05/65] netfilter: nft_compat: make lists per netns Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 06/65] perf script: Fix crash with printing mixed trace point and other events Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 07/65] perf core: Fix perf_proc_update_handler() bug Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 08/65] perf tools: Handle TOPOLOGY headers with no CPU Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 09/65] perf script: Fix crash when processing recorded stat data Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 10/65] IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM Sasha Levin 2019-02-23 21:05 ` Sasha Levin [this message] 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 11/65] iommu/amd: Call free_iova_fast with pfn in map_sg Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 12/65] iommu/amd: Unmap all mapped pages in error path of map_sg Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 13/65] riscv: fixup max_low_pfn with PFN_DOWN Sasha Levin 2019-02-23 21:05 ` Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 14/65] ipvs: Fix signed integer overflow when setsockopt timeout Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 15/65] iommu/amd: Fix IOMMU page flush when detach device from a domain Sasha Levin 2019-02-23 21:05 ` Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 16/65] clk: ti: Fix error handling in ti_clk_parse_divider_data() Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 17/65] clk: qcom: gcc: Use active only source for CPUSS clocks Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 18/65] xtensa: SMP: fix ccount_timer_shutdown Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 19/65] riscv: Adjust mmap base address at a third of task size Sasha Levin 2019-02-23 21:05 ` Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 20/65] IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 21/65] selftests: cpu-hotplug: fix case where CPUs offline > CPUs present Sasha Levin 2019-02-23 21:05 ` Sasha Levin 2019-02-23 21:05 ` sashal 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 22/65] xtensa: SMP: fix secondary CPU initialization Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 23/65] xtensa: smp_lx200_defconfig: fix vectors clash Sasha Levin 2019-02-23 21:05 ` [PATCH AUTOSEL 4.19 24/65] xtensa: SMP: mark each possible CPU as present Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 25/65] iomap: get/put the page in iomap_page_create/release() Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 26/65] iomap: fix a use after free in iomap_dio_rw Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 27/65] xtensa: SMP: limit number of possible CPUs by NR_CPUS Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 28/65] net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 29/65] net: hns: Fix for missing of_node_put() after of_parse_phandle() Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 30/65] net: hns: Restart autoneg need return failed when autoneg off Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 31/65] net: hns: Fix wrong read accesses via Clause 45 MDIO protocol Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 32/65] net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 33/65] netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 34/65] netfilter: nfnetlink_osf: add missing fmatch check Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 35/65] gpio: vf610: Mask all GPIO interrupts Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 36/65] selftests: net: use LDLIBS instead of LDFLAGS Sasha Levin 2019-02-23 21:06 ` Sasha Levin 2019-02-23 21:06 ` sashal 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 37/65] selftests: timers: " Sasha Levin 2019-02-23 21:06 ` Sasha Levin 2019-02-23 21:06 ` sashal 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 38/65] nfs: Fix NULL pointer dereference of dev_name Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 39/65] qed: Fix bug in tx promiscuous mode settings Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 40/65] qed: Fix LACP pdu drops for VFs Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 41/65] qed: Fix VF probe failure while FLR Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 42/65] qed: Fix system crash in ll2 xmit Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 43/65] qed: Fix stack out of bounds bug Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 44/65] scsi: libfc: free skb when receiving invalid flogi resp Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 45/65] scsi: scsi_debug: fix write_same with virtual_gb problem Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 46/65] scsi: bnx2fc: Fix error handling in probe() Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 47/65] scsi: 53c700: pass correct "dev" to dma_alloc_attrs() Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 48/65] platform/x86: Fix unmet dependency warning for ACPI_CMPC Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 49/65] platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 50/65] net: macb: Apply RXUBR workaround only to versions with errata Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 51/65] x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 52/65] cifs: fix computation for MAX_SMB2_HDR_SIZE Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 53/65] blk-mq: fix a hung issue when fsync Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 54/65] x86/microcode/amd: Don't falsely trick the late loading mechanism Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 55/65] arm64: kprobe: Always blacklist the KVM world-switch code Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 56/65] apparmor: Fix aa_label_build() error handling for failed merges Sasha Levin [not found] ` <20190223210640.200911-1-sashal-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 57/65] x86/kexec: Don't setup EFI info if EFI runtime is not enabled Sasha Levin 2019-02-23 21:06 ` Sasha Levin 2019-02-23 21:06 ` Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 58/65] proc: fix /proc/net/* after setns(2) Sasha Levin 2019-02-23 21:06 ` Sasha Levin 2019-02-23 21:06 ` sashal 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 59/65] x86_64: increase stack size for KASAN_EXTRA Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 60/65] mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 61/65] mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 62/65] lib/test_kmod.c: potential double free in error handling Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 63/65] fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 64/65] autofs: drop dentry reference only when it is never used Sasha Levin 2019-02-23 21:06 ` [PATCH AUTOSEL 4.19 65/65] autofs: fix error return in autofs_fill_super() Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190223210640.200911-11-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=iommu@lists.linux-foundation.org \ --cc=joro@8bytes.org \ --cc=jroedel@suse.de \ --cc=jsnitsel@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=stable@vger.kernel.org \ --cc=suravee.suthikulpanit@amd.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.