From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63CA8C433F5 for ; Fri, 15 Apr 2022 10:51:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352494AbiDOKx3 (ORCPT ); Fri, 15 Apr 2022 06:53:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352481AbiDOKxT (ORCPT ); Fri, 15 Apr 2022 06:53:19 -0400 Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0B3D69486 for ; Fri, 15 Apr 2022 03:50:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1650019845; x=1681555845; h=date:from:to:cc:subject:message-id:references: mime-version:content-transfer-encoding:in-reply-to; bh=FcSxV9zaoQXd7xmHux0rD+oliTDOyHpL0739/2mzHhw=; b=f//JHa/rTGkRWG8NszTBkGgEQQcv0CVQPAw2lKqDj0tIp1f/JFNQw19b mGX8I6kWP9/TlbpayYcsikWUn8MCE612K1YJ6z9DYAgjbFqcILbBf8kb0 /E6I58VEnKmOmiK8634TPsm8NHpgZOi/UOuL/2ZiYGcUc2wndQ6f9E9y5 sGuASkkdigHh6eNpVjWHKH+M2Kz3D0SH/mLe6eDsHnR5QYtTeHG/FwJk3 IpMjYJz6nllvHkHP2xV609fcTFY+EykIwt+tydw3AO/lq15VHT3zwVDAm DMumg1BMeg/BGqDBeC0EUMMDsjmqV+IAxJPYlYwfr3g6LvSuzZPhjNF+7 A==; X-IronPort-AV: E=McAfee;i="6400,9594,10317"; a="250434823" X-IronPort-AV: E=Sophos;i="5.90,262,1643702400"; d="scan'208";a="250434823" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Apr 2022 03:50:45 -0700 X-IronPort-AV: E=Sophos;i="5.90,262,1643702400"; d="scan'208";a="574306314" Received: from otcwcpicx3.sc.intel.com ([172.25.55.73]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Apr 2022 03:50:44 -0700 Date: Fri, 15 Apr 2022 03:50:36 -0700 From: Fenghua Yu To: "zhangfei.gao@foxmail.com" Cc: Dave Hansen , Joerg Roedel , jean-philippe , Ravi V Shankar , Tony Luck , Ashok Raj , Peter Zijlstra , Dave Hansen , x86 , linux-kernel , iommu , Ingo Molnar , Borislav Petkov , Andy Lutomirski , Josh Poimboeuf , Thomas Gleixner Subject: Re: [PATCH v4 05/11] iommu/sva: Assign a PASID to mm on PASID allocation and free it on mm exit Message-ID: References: <99bcb9f5-4776-9c40-a776-cdecfa9e1010@foxmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <99bcb9f5-4776-9c40-a776-cdecfa9e1010@foxmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, Zhangfei, On Fri, Apr 15, 2022 at 06:14:09PM +0800, zhangfei.gao@foxmail.com wrote: > > > On 2022/4/15 下午5:51, Fenghua Yu wrote: > > On Thu, Apr 14, 2022 at 06:08:09PM +0800, zhangfei.gao@foxmail.com wrote: > > > On 2022/4/12 下午11:35, zhangfei.gao@foxmail.com wrote: > > > > Hi, Fenghua > > > > > > > > On 2022/4/12 下午9:41, Fenghua Yu wrote: > > From a6444e1e5bd8076f5e5c5e950d3192de327f0c9c Mon Sep 17 00:00:00 2001 > > From: Fenghua Yu > > Date: Fri, 15 Apr 2022 00:51:33 -0700 > > Subject: [RFC PATCH] iommu/sva: Fix PASID use-after-free issue > > > > A PASID might be still used even though it is freed on mm exit. > > > > process A: > > sva_bind(); > > ioasid_alloc() = N; // Get PASID N for the mm > > fork(): // spawn process B > > exit(); > > ioasid_free(N); > > > > process B: > > device uses PASID N -> failure > > sva_unbind(); > > > > Dave Hansen suggests to take a refcount on the mm whenever binding the > > PASID to a device and drop the refcount on unbinding. The mm won't be > > dropped if the PASID is still bound to it. > > > > Fixes: 701fac40384f ("iommu/sva: Assign a PASID to mm on PASID allocation and free it on mm exit") > > > > Reported-by: Zhangfei Gao > > Suggested-by: Dave Hansen" > > Signed-off-by: Fenghua Yu > > --- > > drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 6 ++++++ > > drivers/iommu/intel/svm.c | 4 ++++ > > 2 files changed, 10 insertions(+) > > > > diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c > > index 22ddd05bbdcd..3fcb842a0df0 100644 > > --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c > > +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c > > @@ -7,6 +7,7 @@ > > #include > > #include > > #include > > +#include > > #include "arm-smmu-v3.h" > > #include "../../iommu-sva-lib.h" > > @@ -363,6 +364,9 @@ arm_smmu_sva_bind(struct device *dev, struct mm_struct *mm, void *drvdata) > > mutex_lock(&sva_lock); > > handle = __arm_smmu_sva_bind(dev, mm); > > + /* Take an mm refcount on a successful bind. */ > > + if (!IS_ERR(handle)) > > + mmget(mm); > > mutex_unlock(&sva_lock); > > return handle; > > } > > @@ -372,6 +376,8 @@ void arm_smmu_sva_unbind(struct iommu_sva *handle) > > struct arm_smmu_bond *bond = sva_to_bond(handle); > > mutex_lock(&sva_lock); > > + /* Drop an mm refcount. */ > > + mmput(bond->mm); > > if (refcount_dec_and_test(&bond->refs)) { > > list_del(&bond->list); > > arm_smmu_mmu_notifier_put(bond->smmu_mn); > > diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c > > index 23a38763c1d1..345a0d5d7922 100644 > > --- a/drivers/iommu/intel/svm.c > > +++ b/drivers/iommu/intel/svm.c > > @@ -403,6 +403,8 @@ static struct iommu_sva *intel_svm_bind_mm(struct intel_iommu *iommu, > > goto free_sdev; > > list_add_rcu(&sdev->list, &svm->devs); > > + /* Take an mm refcount on binding mm. */ > > + mmget(mm); > > success: > > return &sdev->sva; > > @@ -465,6 +467,8 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid) > > kfree(svm); > > } > > } > > + /* Drop an mm reference on unbinding mm. */ > > + mmput(mm); > > } > > out: > > return ret; > This patch can not be applied on 5.18-rc2 for intel part. What error do you see? Could you please send to me errors? I download this patch from: https://lore.kernel.org/lkml/YllADL6uMoLllzQo@fyu1.sc.intel.com/raw git am to either v5.18-rc2 or the latest upstream without any issue. > It should work for arm. > > In fact I have a similar patch at hand but pending since I found an issue. > > I start & stop nginx via this cmd. > //start > sudo sbin/nginx                    // this alloc an ioasid=1 > //stop > sudo sbin/nginx -s quit    // this does not free ioasid=1, but still alloc > ioasid=2. > So ioasid will keep allocated but not freed if continue start/stop nginx,  > though not impact the nginx function. > > stop nginx with -s quit still calls > src/core/nginx.c > main -> ngx_ssl_init -> openssl engine:    bind_fn -> ... -> alloc asid > But openssl engine: ENGINE_free is not called > > Still in checking nginx code. > > Or do you test with nginx? On my X86 machine, nginx doesn't trigger the kernel sva binding function to allocate ioasid. I tried pre- nstalled nginx/openssl and also tried my built a few versions of nginx/openssl. nginx does call OPENSSL_init_ssl() but doesn't go to the binding function. Don't know if it's my configuration issue. Maybe you can give me some advice? I test the patch with a few internal test tools and observe mmget()/mmput() works fine in various cases. Thanks. -Fenghua