From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Jan Beulich" <JBeulich@suse.com>
Subject: Re: [Patch 1/2] x86/vtd: Fix suspected data race
 condition in iommu_set_root_entry()
Date: Mon, 07 Oct 2013 11:03:20 +0100
Message-ID: <5252A30802000078000F92C6@nat28.tlf.novell.com>
References: <1381139316-1820-1-git-send-email-andrew.cooper3@citrix.com>
	<1381139316-1820-2-git-send-email-andrew.cooper3@citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Received: from mail6.bemta14.messagelabs.com ([193.109.254.103])
	by lists.xen.org with esmtp (Exim 4.72)
	(envelope-from <JBeulich@suse.com>) id 1VT7ev-0007BQ-Ds
	for xen-devel@lists.xenproject.org; Mon, 07 Oct 2013 10:03:25 +0000
In-Reply-To: <1381139316-1820-2-git-send-email-andrew.cooper3@citrix.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: xen-devel <xen-devel@lists.xenproject.org>, Keir Fraser <keir@xen.org>, Xiantao Zhang <xiantao.zhang@intel.com>
List-Id: xen-devel@lists.xenproject.org

>>> On 07.10.13 at 11:48, Andrew Cooper <andrew.cooper3@citrix.com> wrote:
> Coverity ID: 1054967
> 
> Coverity spotted that iommu->root_maddr was optionally allocated within the
> protection of the iommu->lock, but was referenced with the protection of the
> iommu->register_lock, and freed without any lock.
> 
> Luckily, the code as-is is not vulnerable to the potential risks identified.
> 
> However, the alloc_pgtable_maddr() is far more appropriately done in
> iommu_alloc(), removing a set of spinlock calls, and a possibility for the
> iommu setup to fail later than iommu_alloc() with an -ENOMEM.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> CC: Keir Fraser <keir@xen.org>

Reviewed-by: Jan Beulich <jbeulich@suse.com>

> CC: Xiantao Zhang <xiantao.zhang@intel.com>
> ---
>  xen/drivers/passthrough/vtd/iommu.c |   19 +++----------------
>  1 file changed, 3 insertions(+), 16 deletions(-)
> 
> diff --git a/xen/drivers/passthrough/vtd/iommu.c 
> b/xen/drivers/passthrough/vtd/iommu.c
> index 12e0165..2dbe97a 100644
> --- a/xen/drivers/passthrough/vtd/iommu.c
> +++ b/xen/drivers/passthrough/vtd/iommu.c
> @@ -696,25 +696,9 @@ static void iommu_free_pagetable(u64 pt_maddr, int 
> level)
>  
>  static int iommu_set_root_entry(struct iommu *iommu)
>  {
> -    struct acpi_drhd_unit *drhd;
>      u32 sts;
>      unsigned long flags;
>  
> -    spin_lock(&iommu->lock);
> -
> -    if ( iommu->root_maddr == 0 )
> -    {
> -        drhd = iommu_to_drhd(iommu);
> -        iommu->root_maddr = alloc_pgtable_maddr(drhd, 1);
> -    }
> -
> -    if ( iommu->root_maddr == 0 )
> -    {
> -        spin_unlock(&iommu->lock);
> -        return -ENOMEM;
> -    }
> -
> -    spin_unlock(&iommu->lock);
>      spin_lock_irqsave(&iommu->register_lock, flags);
>      dmar_writeq(iommu->reg, DMAR_RTADDR_REG, iommu->root_maddr);
>  
> @@ -1144,6 +1128,9 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd)
>      iommu->intel->drhd = drhd;
>      drhd->iommu = iommu;
>  
> +    if ( !(iommu->root_maddr = alloc_pgtable_maddr(drhd, 1)) )
> +        return -ENOMEM;
> +
>      iommu->reg = ioremap(drhd->address, PAGE_SIZE);
>      if ( !iommu->reg )
>          return -ENOMEM;
> -- 
> 1.7.10.4