From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Zhang, Xiantao" Subject: Re: [Patch 1/2] x86/vtd: Fix suspected data race condition in iommu_set_root_entry() Date: Mon, 7 Oct 2013 14:50:16 +0000 Message-ID: References: <1381139316-1820-1-git-send-email-andrew.cooper3@citrix.com> <1381139316-1820-2-git-send-email-andrew.cooper3@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1381139316-1820-2-git-send-email-andrew.cooper3@citrix.com> Content-Language: en-US List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Andrew Cooper , Xen-devel Cc: Keir Fraser , Jan Beulich List-Id: xen-devel@lists.xenproject.org Thanks, Acked-by: Xiantao Zhang Xiantao -----Original Message----- From: Andrew Cooper [mailto:andrew.cooper3@citrix.com] Sent: Monday, October 7, 2013 5:49 PM To: Xen-devel Cc: Andrew Cooper; Keir Fraser; Jan Beulich; Zhang, Xiantao Subject: [Xen-devel] [Patch 1/2] x86/vtd: Fix suspected data race condition in iommu_set_root_entry() Coverity ID: 1054967 Coverity spotted that iommu->root_maddr was optionally allocated within the protection of the iommu->lock, but was referenced with the protection of the iommu->register_lock, and freed without any lock. Luckily, the code as-is is not vulnerable to the potential risks identified. However, the alloc_pgtable_maddr() is far more appropriately done in iommu_alloc(), removing a set of spinlock calls, and a possibility for the iommu setup to fail later than iommu_alloc() with an -ENOMEM. Signed-off-by: Andrew Cooper CC: Keir Fraser CC: Jan Beulich CC: Xiantao Zhang --- xen/drivers/passthrough/vtd/iommu.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 12e0165..2dbe97a 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -696,25 +696,9 @@ static void iommu_free_pagetable(u64 pt_maddr, int level) static int iommu_set_root_entry(struct iommu *iommu) { - struct acpi_drhd_unit *drhd; u32 sts; unsigned long flags; - spin_lock(&iommu->lock); - - if ( iommu->root_maddr == 0 ) - { - drhd = iommu_to_drhd(iommu); - iommu->root_maddr = alloc_pgtable_maddr(drhd, 1); - } - - if ( iommu->root_maddr == 0 ) - { - spin_unlock(&iommu->lock); - return -ENOMEM; - } - - spin_unlock(&iommu->lock); spin_lock_irqsave(&iommu->register_lock, flags); dmar_writeq(iommu->reg, DMAR_RTADDR_REG, iommu->root_maddr); @@ -1144,6 +1128,9 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd) iommu->intel->drhd = drhd; drhd->iommu = iommu; + if ( !(iommu->root_maddr = alloc_pgtable_maddr(drhd, 1)) ) + return -ENOMEM; + iommu->reg = ioremap(drhd->address, PAGE_SIZE); if ( !iommu->reg ) return -ENOMEM; -- 1.7.10.4