Messages in this thread |  | | Date | Mon, 2 May 2022 13:42:16 -0300 | From | Jason Gunthorpe <> | Subject | Re: [RESEND PATCH v8 00/11] Fix BUG_ON in vfio_iommu_group_notifier() |
| |
On Mon, May 02, 2022 at 12:12:04PM -0400, Qian Cai wrote: > On Mon, Apr 18, 2022 at 08:49:49AM +0800, Lu Baolu wrote: > > Hi Joerg, > > > > This is a resend version of v8 posted here: > > https://lore.kernel.org/linux-iommu/20220308054421.847385-1-baolu.lu@linux.intel.com/ > > as we discussed in this thread: > > https://lore.kernel.org/linux-iommu/Yk%2Fq1BGN8pC5HVZp@8bytes.org/ > > > > All patches can be applied perfectly except this one: > > - [PATCH v8 02/11] driver core: Add dma_cleanup callback in bus_type > > It conflicts with below refactoring commit: > > - 4b775aaf1ea99 "driver core: Refactor sysfs and drv/bus remove hooks" > > The conflict has been fixed in this post. > > > > No functional changes in this series. I suppress cc-ing this series to > > all v8 reviewers in order to avoid spam. > > > > Please consider it for your iommu tree. > > Reverting this series fixed an user-after-free while doing SR-IOV. > > BUG: KASAN: use-after-free in __lock_acquire > Read of size 8 at addr ffff080279825d78 by task qemu-system-aar/22429 > CPU: 24 PID: 22429 Comm: qemu-system-aar Not tainted 5.18.0-rc5-next-20220502 #69 > Call trace: > dump_backtrace > show_stack > dump_stack_lvl > print_address_description.constprop.0 > print_report > kasan_report > __asan_report_load8_noabort > __lock_acquire > lock_acquire.part.0 > lock_acquire > _raw_spin_lock_irqsave > arm_smmu_detach_dev > arm_smmu_detach_dev at drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:2377 > arm_smmu_attach_dev
Hum.
So what has happened is that VFIO does this sequence:
iommu_detach_group() iommu_domain_free() iommu_group_release_dma_owner()
Which, I think should be valid, API wise.
From what I can see reading the code SMMUv3 blows up above because it doesn't have a detach_dev op:
.default_domain_ops = &(const struct iommu_domain_ops) { .attach_dev = arm_smmu_attach_dev, .map_pages = arm_smmu_map_pages, .unmap_pages = arm_smmu_unmap_pages, .flush_iotlb_all = arm_smmu_flush_iotlb_all, .iotlb_sync = arm_smmu_iotlb_sync, .iova_to_phys = arm_smmu_iova_to_phys, .enable_nesting = arm_smmu_enable_nesting, .free = arm_smmu_domain_free, }
But it is internally tracking the domain inside the master - so when the next domain is attached it does this:
static void arm_smmu_detach_dev(struct arm_smmu_master *master) { struct arm_smmu_domain *smmu_domain = master->domain;
spin_lock_irqsave(&smmu_domain->devices_lock, flags);
And explodes as the domain has been freed but master->domain was not NULL'd.
It worked before because iommu_detach_group() used to attach the default group and that was before the domain was freed in the above sequence.
I'm guessing SMMU3 needs to call it's arm_smmu_detach_dev(master) from the detach_dev op and null it's cached copy of the domain, but I don't know this driver.. Robin?
Thanks, Jason
|  |