On Tue, Mar 05, 2024 at 01:01:12PM +0530, Nikhil V wrote: > > > On 3/4/2024 6:55 PM, Greg KH wrote: > > On Mon, Mar 04, 2024 at 04:40:50PM +0530, Nikhil V wrote: > > > From: Charan Teja Kalla <quic_charante@xxxxxxxxxxx> > > > > > > This fix is applicable for LTS kernel, 6.1.y. In latest kernels, this race > > > issue is fixed by the patch series [1] and [2]. The right thing to do here > > > would have been propagating these changes from latest kernel to the stable > > > branch, 6.1.y. However, these changes seems too intrusive to be picked for > > > stable branches. Hence, the fix proposed can be taken as an alternative > > > instead of backporting the patch series. > > > [1] https://lore.kernel.org/all/0-v8-81230027b2fa+9d-iommu_all_defdom_jgg@xxxxxxxxxx/ > > > [2] https://lore.kernel.org/all/0-v5-1b99ae392328+44574-iommu_err_unwind_jgg@xxxxxxxxxx/ > > > > > > Issue: > > > A race condition is observed when arm_smmu_device_probe and > > > modprobe of client devices happens in parallel. This results > > > in the allocation of a new default domain for the iommu group > > > even though it was previously allocated and the respective iova > > > domain(iovad) was initialized. However, for this newly allocated > > > default domain, iovad will not be initialized. As a result, for > > > devices requesting dma allocations, this uninitialized iovad will > > > be used, thereby causing NULL pointer dereference issue. > > > > > > Flow: > > > - During arm_smmu_device_probe, bus_iommu_probe() will be called > > > as part of iommu_device_register(). This results in the device probe, > > > __iommu_probe_device(). > > > > > > - When the modprobe of the client device happens in parallel, it > > > sets up the DMA configuration for the device using of_dma_configure_id(), > > > which inturn calls iommu_probe_device(). Later, default domain is > > > allocated and attached using iommu_alloc_default_domain() and > > > __iommu_attach_device() respectively. It then ends up initializing a > > > mapping domain(IOVA domain) and rcaches for the device via > > > arch_setup_dma_ops()->iommu_setup_dma_ops(). > > > > > > - Now, in the bus_iommu_probe() path, it again tries to allocate > > > a default domain via probe_alloc_default_domain(). This results in > > > allocating a new default domain(along with IOVA domain) via > > > __iommu_domain_alloc(). However, this newly allocated IOVA domain > > > will not be initialized. > > > > > > - Now, when the same client device tries dma allocations via > > > iommu_dma_alloc(), it ends up accessing the rcaches of the newly > > > allocated IOVA domain, which is not initialized. This results > > > into NULL pointer dereferencing. > > > > > > Fix this issue by adding a check in probe_alloc_default_domain() > > > to see if the iommu_group already has a default domain allocated > > > and initialized. > > > > > > Cc: <stable@xxxxxxxxxxxxxxx> # see patch description, fix applicable only for 6.1.y > > > Signed-off-by: Charan Teja Kalla <quic_charante@xxxxxxxxxxx> > > > Co-developed-by: Nikhil V <quic_nprakash@xxxxxxxxxxx> > > > Signed-off-by: Nikhil V <quic_nprakash@xxxxxxxxxxx> > > > --- > > > drivers/iommu/iommu.c | 3 +++ > > > 1 file changed, 3 insertions(+) > > > > Why RESEND? What happened to the first send? > > > > thanks, > > > > greg k-h > > > Hi Greg, > > There are no changes as such w.r.t first send, [1]. It is resent to gain > attention on this patch. Also, we have added a proper Cc: stable tag with > this patch. Thanks, now queued up. greg k-h
