From: Thomas Gleixner <tglx@linutronix.de>
To: Fenghua Yu <fenghua.yu@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Peter Zijlstra <peterz@infradead.org>,
Andy Lutomirski <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Tony Luck <tony.luck@intel.com>,
Lu Baolu <baolu.lu@linux.intel.com>,
Joerg Roedel <joro@8bytes.org>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Jacob Pan <jacob.jun.pan@linux.intel.com>,
Ashok Raj <ashok.raj@intel.com>,
Ravi V Shankar <ravi.v.shankar@intel.com>,
iommu@lists.linux-foundation.org, x86 <x86@kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2 05/11] iommu/sva: Assign a PASID to mm on PASID allocation and free it on mm exit
Date: Wed, 26 Jan 2022 22:38:04 +0100 [thread overview]
Message-ID: <8735la41qb.ffs@tglx> (raw)
In-Reply-To: <YfGGk7kWNc9q2YwV@otcwcpicx3.sc.intel.com>
On Wed, Jan 26 2022 at 09:36, Fenghua Yu wrote:
> On Wed, Jan 26, 2022 at 03:23:42PM +0100, Thomas Gleixner wrote:
>> On Tue, Jan 25 2022 at 07:18, Fenghua Yu wrote:
>> While looking at ioasid_put() usage I tripped over the following UAF
>> issue:
>>
>> --- a/drivers/iommu/intel/iommu.c
>> +++ b/drivers/iommu/intel/iommu.c
>> @@ -4817,8 +4817,10 @@ static int aux_domain_add_dev(struct dma
>> auxiliary_unlink_device(domain, dev);
>> link_failed:
>> spin_unlock_irqrestore(&device_domain_lock, flags);
>> - if (list_empty(&domain->subdevices) && domain->default_pasid > 0)
>> + if (list_empty(&domain->subdevices) && domain->default_pasid > 0) {
>> ioasid_put(domain->default_pasid);
>> + domain->default_pasid = INVALID_IOASID;
>> + }
>>
>> return ret;
>> }
>> @@ -4847,8 +4849,10 @@ static void aux_domain_remove_dev(struct
>>
>> spin_unlock_irqrestore(&device_domain_lock, flags);
>>
>> - if (list_empty(&domain->subdevices) && domain->default_pasid > 0)
>> + if (list_empty(&domain->subdevices) && domain->default_pasid > 0) {
>> ioasid_put(domain->default_pasid);
>> + domain->default_pasid = INVALID_IOASID;
>> + }
>> }
>>
>> static int prepare_domain_attach_device(struct iommu_domain *domain,
>
> The above patch fixes an existing issue. I will put it in a separate patch,
> right?
Correct.
> It cannot be applied cleanly to the upstream tree. Do you want me to base
> the above patch (and the whole patch set) to the upstream tree or a specific
> tip branch?
Against Linus tree please so that the bugfix applies.
> I will fold the following patch into patch #5. The patch #11 (the doc patch)
> also needs to remove one paragraph talking about refcount.
>
> So I will send the whole patch set with the following changes:
> 1. One new bug fix patch (the above patch)
> 2. Updated patch #5 (with the following patch folded)
> 3. Updated patch #11 (removing refcount description)
Looks good.
Thanks,
tglx
next prev parent reply other threads:[~2022-01-26 21:38 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-17 22:01 [PATCH v2 00/11] Re-enable ENQCMD and PASID MSR Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 01/11] iommu/sva: Rename CONFIG_IOMMU_SVA_LIB to CONFIG_IOMMU_SVA Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 02/11] mm: Change CONFIG option for mm->pasid field Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 03/11] iommu/ioasid: Introduce a helper to check for valid PASIDs Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 04/11] kernel/fork: Initialize mm's PASID Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 05/11] iommu/sva: Assign a PASID to mm on PASID allocation and free it on mm exit Fenghua Yu
2022-01-24 20:21 ` Thomas Gleixner
2022-01-24 20:33 ` Fenghua Yu
2022-01-24 20:36 ` Thomas Gleixner
2022-01-24 20:52 ` Fenghua Yu
2022-01-24 20:55 ` Thomas Gleixner
2022-01-25 15:18 ` Fenghua Yu
2022-01-26 14:23 ` Thomas Gleixner
2022-01-26 17:36 ` Fenghua Yu
2022-01-26 21:38 ` Thomas Gleixner [this message]
2022-01-28 2:42 ` Fenghua Yu
2022-01-28 14:53 ` Thomas Gleixner
2021-12-17 22:01 ` [PATCH v2 06/11] x86/fpu: Clear PASID when copying fpstate Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 07/11] sched: Define and initialize a flag to identify valid PASID in the task Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 08/11] x86/traps: Demand-populate PASID MSR via #GP Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 09/11] x86/cpufeatures: Re-enable ENQCMD Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 10/11] tools/objtool: Check for use of the ENQCMD instruction in the kernel Fenghua Yu
2021-12-17 22:57 ` Josh Poimboeuf
2021-12-27 17:50 ` Fenghua Yu
2021-12-17 22:01 ` [PATCH v2 11/11] docs: x86: Change documentation for SVA (Shared Virtual Addressing) Fenghua Yu
2021-12-27 17:52 ` [PATCH v2 00/11] Re-enable ENQCMD and PASID MSR Fenghua Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8735la41qb.ffs@tglx \
--to=tglx@linutronix.de \
--cc=ashok.raj@intel.com \
--cc=baolu.lu@linux.intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=fenghua.yu@intel.com \
--cc=iommu@lists.linux-foundation.org \
--cc=jacob.jun.pan@linux.intel.com \
--cc=joro@8bytes.org \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=ravi.v.shankar@intel.com \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).