[RHEL6.8 PATCH 3/3] iommu/vt-d: Fix dmar_domain leak in iommu_attach_device

[RHEL6.8 PATCH 3/3] iommu/vt-d: Fix dmar_domain leak in iommu_attach_device

[Linda Knippers]

bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1053879

This is a backport to RHEL6 of Myron's backport to RHEL7.
http://post-office.corp.redhat.com/archives/rhkernel-list/2015-January/msg00231.html

As Myron notes, the helper functions in the upstream code aren't
present in RHEL6 or RHEL7 so this code is less readable.  Myron
didn't backport the helpers because he's planning to rebase the
code in RHEL7.2.  I didn't backport the helpers to not introduce
more change.

Myron's comments:

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1109829
Upstream Status: 62c22167dd70b730f61c2b88f950e98154a87980
>>From Joerg's iommu/fixes branch intended for v3.19 -
https://git.kernel.org/cgit/linux/kernel/git/joro/iommu.git/commit/?h=iommu/fixes&id=62c22167dd70b730f61c2b88f950e98154a87980

Conflict:
  This patch has a dependency on upstream commit ab8dfe2 ("iommu/vt-d:
  Introduce helper functions to improve code readability") which was
  introduced during v3.17-rc1.  RHEL7 does not have that commit, and
thus
  does not have 'domain_type_is_vm_or_si()'.  As such, this back-port
uses
  the older method used prior to the introduction of
  'domain_type_is_vm_or_si() (see upstream commit ab8dfe2).

commit 62c22167dd70b730f61c2b88f950e98154a87980
Author: Joerg Roedel <jroedel@suse.de>
Date:   Tue Dec 9 12:56:45 2014 +0100

    iommu/vt-d: Fix dmar_domain leak in iommu_attach_device

    Since commit 1196c2f a domain is only destroyed in the
    notifier path if it is hot-unplugged. This caused a
    domain leakage in iommu_attach_device when a driver was
    unbound from the device and bound to VFIO. In this case the
    device is attached to a new domain and unlinked from the old
    domain. At this point nothing points to the old domain
    anymore and its memory is leaked.
    Fix this by explicitly freeing the old domain in
    iommu_attach_domain.

Fixes: 1196c2f (iommu/vt-d: Fix dmar_domain leak in iommu_attach_device)
Cc: <stable@vger.kernel.org> # v3.18
Tested-by: Jerry Hoemann <jerry.hoemann@hp.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Linda Knippers <lknipper@redhat.com>
---
 drivers/pci/intel-iommu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 1c04ed8..80bd6d76 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -3851,6 +3851,11 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
 				domain_remove_one_dev_info(old_domain, pdev);
 			else
 				domain_remove_dev_info(old_domain);
+
+			if (!(old_domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
+			    !(old_domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+			    list_empty(&old_domain->devices))
+				domain_exit(old_domain);
 		}
 	}
 
-- 
1.8.3.1

Re: [RHEL6.8 PATCH 3/3] iommu/vt-d: Fix dmar_domain leak in iommu_attach_device

[Shuah Khan]

On Tue, Nov 10, 2015 at 1:12 PM, Linda Knippers <lknipper@redhat.com> wrote:
> bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1053879
>
> This is a backport to RHEL6 of Myron's backport to RHEL7.
> http://post-office.corp.redhat.com/archives/rhkernel-list/2015-January/msg00231.html
>
> As Myron notes, the helper functions in the upstream code aren't
> present in RHEL6 or RHEL7 so this code is less readable.  Myron
> didn't backport the helpers because he's planning to rebase the
> code in RHEL7.2.  I didn't backport the helpers to not introduce
> more change.
>
> Myron's comments:
>
> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1109829
> Upstream Status: 62c22167dd70b730f61c2b88f950e98154a87980
> >From Joerg's iommu/fixes branch intended for v3.19 -
> https://git.kernel.org/cgit/linux/kernel/git/joro/iommu.git/commit/?h=iommu/fixes&id=62c22167dd70b730f61c2b88f950e98154a87980
>
> Conflict:
>   This patch has a dependency on upstream commit ab8dfe2 ("iommu/vt-d:
>   Introduce helper functions to improve code readability") which was
>   introduced during v3.17-rc1.  RHEL7 does not have that commit, and
> thus
>   does not have 'domain_type_is_vm_or_si()'.  As such, this back-port
> uses
>   the older method used prior to the introduction of
>   'domain_type_is_vm_or_si() (see upstream commit ab8dfe2).
>
> commit 62c22167dd70b730f61c2b88f950e98154a87980
> Author: Joerg Roedel <jroedel@suse.de>
> Date:   Tue Dec 9 12:56:45 2014 +0100
>
>     iommu/vt-d: Fix dmar_domain leak in iommu_attach_device
>
>     Since commit 1196c2f a domain is only destroyed in the
>     notifier path if it is hot-unplugged. This caused a
>     domain leakage in iommu_attach_device when a driver was
>     unbound from the device and bound to VFIO. In this case the
>     device is attached to a new domain and unlinked from the old
>     domain. At this point nothing points to the old domain
>     anymore and its memory is leaked.
>     Fix this by explicitly freeing the old domain in
>     iommu_attach_domain.

There is a lot of information in this commit log that isn't appropriate
for a commit log. This information is better fit in the section that goes
in the throw away comments section of the patch. This commit message
is rather confusing and could use some refining.

thanks,
-- Shuah
>
> Fixes: 1196c2f (iommu/vt-d: Fix dmar_domain leak in iommu_attach_device)
> Cc: <stable@vger.kernel.org> # v3.18
> Tested-by: Jerry Hoemann <jerry.hoemann@hp.com>
> Signed-off-by: Joerg Roedel <jroedel@suse.de>
> Signed-off-by: Linda Knippers <lknipper@redhat.com>
> ---
>  drivers/pci/intel-iommu.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
> index 1c04ed8..80bd6d76 100644
> --- a/drivers/pci/intel-iommu.c
> +++ b/drivers/pci/intel-iommu.c
> @@ -3851,6 +3851,11 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
>                                 domain_remove_one_dev_info(old_domain, pdev);
>                         else
>                                 domain_remove_dev_info(old_domain);
> +
> +                       if (!(old_domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
> +                           !(old_domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
> +                           list_empty(&old_domain->devices))
> +                               domain_exit(old_domain);
>                 }
>         }
>
> --
> 1.8.3.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [RHEL6.8 PATCH 3/3] iommu/vt-d: Fix dmar_domain leak in iommu_attach_device

[Linda Knippers]

This mail was sent by mistake.
Please ignore.

Sorry for the noise.

-- ljk

On 11/12/2015 09:47 AM, Shuah Khan wrote:
> On Tue, Nov 10, 2015 at 1:12 PM, Linda Knippers <lknipper@redhat.com> wrote:
>> bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1053879
>>
>> This is a backport to RHEL6 of Myron's backport to RHEL7.
>> http://post-office.corp.redhat.com/archives/rhkernel-list/2015-January/msg00231.html
>>
>> As Myron notes, the helper functions in the upstream code aren't
>> present in RHEL6 or RHEL7 so this code is less readable.  Myron
>> didn't backport the helpers because he's planning to rebase the
>> code in RHEL7.2.  I didn't backport the helpers to not introduce
>> more change.
>>
>> Myron's comments:
>>
>> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1109829
>> Upstream Status: 62c22167dd70b730f61c2b88f950e98154a87980
>> >From Joerg's iommu/fixes branch intended for v3.19 -
>> https://git.kernel.org/cgit/linux/kernel/git/joro/iommu.git/commit/?h=iommu/fixes&id=62c22167dd70b730f61c2b88f950e98154a87980
>>
>> Conflict:
>>   This patch has a dependency on upstream commit ab8dfe2 ("iommu/vt-d:
>>   Introduce helper functions to improve code readability") which was
>>   introduced during v3.17-rc1.  RHEL7 does not have that commit, and
>> thus
>>   does not have 'domain_type_is_vm_or_si()'.  As such, this back-port
>> uses
>>   the older method used prior to the introduction of
>>   'domain_type_is_vm_or_si() (see upstream commit ab8dfe2).
>>
>> commit 62c22167dd70b730f61c2b88f950e98154a87980
>> Author: Joerg Roedel <jroedel@suse.de>
>> Date:   Tue Dec 9 12:56:45 2014 +0100
>>
>>     iommu/vt-d: Fix dmar_domain leak in iommu_attach_device
>>
>>     Since commit 1196c2f a domain is only destroyed in the
>>     notifier path if it is hot-unplugged. This caused a
>>     domain leakage in iommu_attach_device when a driver was
>>     unbound from the device and bound to VFIO. In this case the
>>     device is attached to a new domain and unlinked from the old
>>     domain. At this point nothing points to the old domain
>>     anymore and its memory is leaked.
>>     Fix this by explicitly freeing the old domain in
>>     iommu_attach_domain.
> 
> There is a lot of information in this commit log that isn't appropriate
> for a commit log. This information is better fit in the section that goes
> in the throw away comments section of the patch. This commit message
> is rather confusing and could use some refining.
> 
> thanks,
> -- Shuah
>>
>> Fixes: 1196c2f (iommu/vt-d: Fix dmar_domain leak in iommu_attach_device)
>> Cc: <stable@vger.kernel.org> # v3.18
>> Tested-by: Jerry Hoemann <jerry.hoemann@hp.com>
>> Signed-off-by: Joerg Roedel <jroedel@suse.de>
>> Signed-off-by: Linda Knippers <lknipper@redhat.com>
>> ---
>>  drivers/pci/intel-iommu.c | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
>> index 1c04ed8..80bd6d76 100644
>> --- a/drivers/pci/intel-iommu.c
>> +++ b/drivers/pci/intel-iommu.c
>> @@ -3851,6 +3851,11 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
>>                                 domain_remove_one_dev_info(old_domain, pdev);
>>                         else
>>                                 domain_remove_dev_info(old_domain);
>> +
>> +                       if (!(old_domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
>> +                           !(old_domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
>> +                           list_empty(&old_domain->devices))
>> +                               domain_exit(old_domain);
>>                 }
>>         }
>>
>> --
>> 1.8.3.1
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe stable" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html