On Tue, Aug 13, 2024 at 03:28:03PM -0400, Matthew Rosato wrote: > This fixes a crash when surprise hot-unplugging a PCI device. This crash > happens because during hot-unplug __iommu_group_set_domain_nofail() > attaching the default domain fails when the platform no longer > recognizes the device as it has already been removed and we end up with > a NULL domain pointer and UAF. This is exactly the case referred to in > the second comment in __iommu_device_set_domain() and just as stated > there if we can instead attach the blocking domain the UAF is prevented > as this can handle the already removed device. Implement the blocking > domain to use this handling. With this change, the crash is fixed but > we still hit a warning attempting to change DMA ownership on a blocked > device. > > Fixes: c76c067e488c ("s390/pci: Use dma-iommu layer") > Co-developed-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx> > Signed-off-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx> > Signed-off-by: Matthew Rosato <mjrosato@xxxxxxxxxxxxx> > --- > Changes for v2: > - Added co-author tag from Niklas + my SoB > - Removed changes to drivers/iommu/iommu.c > - Revert back to -EIO for failed attach in s390-iommu > - Set blocking domain during probe_device / remove s390_domain check during > blocking attach > - Remove s390_iommu_release_device > - Update commit message to reflect changes > --- > drivers/iommu/s390-iommu.c | 64 ++++++++++++++++++++++++++------------ > 1 file changed, 44 insertions(+), 20 deletions(-) This is probably OK as is, but there are a few things that don't quite match the pattern still here The blocking domain should be the iommu_domain type since it is global and shared. None of the additional driver members should ever be touched as that would maybe become dangerous. > +static struct s390_domain s390_blocking_domain = { Ideally would be struct iommu_domain s390_blocking_domain That in turn means going around and looking carefully at zdev->s390_domain. All uses can probably be removed except for this: struct zpci_iommu_ctrs *zpci_get_iommu_ctrs(struct zpci_dev *zdev) { if (!zdev || !zdev->s390_domain) return NULL; return &zdev->s390_domain->ctrs; } Which doesn't look good for a blocking domain anyhow. Also the above looks racy, nothing prevents s390_domain from being freed if it is read outside an iommu op. The checks for null zdev also don't make sense: static int blocking_domain_attach_device(struct iommu_domain *domain, struct device *dev) { struct s390_domain *s390_domain = to_s390_domain(domain); struct zpci_dev *zdev = to_zpci_dev(dev); unsigned long flags; if (!zdev) return 0; The core guarentees these functions are never called unless probe succeeds and probe won't succeed if zdev is NULL. And it would be good to rename s390_iommu_detach_device() to blocking_domain_attach_device(), then the obsolete "detach" naming is gone and this driver just uses a blocked before attach pattern. > @@ -403,16 +414,14 @@ static int s390_iommu_attach_device(struct iommu_domain *domain, > > if (zdev->s390_domain) > s390_iommu_detach_device(&zdev->s390_domain->domain, dev); s390_domain is never NULL now, the test can go away > +static int blocking_domain_attach_device(struct iommu_domain *domain, > + struct device *dev) > +{ > + struct s390_domain *s390_domain = to_s390_domain(domain); > + struct zpci_dev *zdev = to_zpci_dev(dev); > + unsigned long flags; flags is never used? Compiler didn't warn? Jason