[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200408143707.GK3103@8bytes.org>
Date: Wed, 8 Apr 2020 16:37:07 +0200
From: Joerg Roedel <joro@...tes.org>
To: Robin Murphy <robin.murphy@....com>
Cc: Will Deacon <will@...nel.org>,
Marek Szyprowski <m.szyprowski@...sung.com>,
Kukjin Kim <kgene@...nel.org>,
Krzysztof Kozlowski <krzk@...nel.org>,
David Woodhouse <dwmw2@...radead.org>,
Lu Baolu <baolu.lu@...ux.intel.com>,
Andy Gross <agross@...nel.org>,
Bjorn Andersson <bjorn.andersson@...aro.org>,
Matthias Brugger <matthias.bgg@...il.com>,
Rob Clark <robdclark@...il.com>,
Heiko Stuebner <heiko@...ech.de>,
Gerald Schaefer <gerald.schaefer@...ibm.com>,
Thierry Reding <thierry.reding@...il.com>,
Jonathan Hunter <jonathanh@...dia.com>,
Jean-Philippe Brucker <jean-philippe@...aro.org>,
iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
linux-samsung-soc@...r.kernel.org, linux-arm-msm@...r.kernel.org,
linux-mediatek@...ts.infradead.org,
linux-rockchip@...ts.infradead.org, linux-s390@...r.kernel.org,
linux-tegra@...r.kernel.org,
virtualization@...ts.linux-foundation.org,
Joerg Roedel <jroedel@...e.de>
Subject: Re: [RFC PATCH 17/34] iommu/arm-smmu: Store device instead of group
in arm_smmu_s2cr
Hi Robin,
thanks for looking into this.
On Wed, Apr 08, 2020 at 01:09:40PM +0100, Robin Murphy wrote:
> For a hot-pluggable bus where logical devices may share Stream IDs (like
> fsl-mc), this could happen:
>
> create device A
> iommu_probe_device(A)
> iommu_device_group(A) -> alloc group X
> create device B
> iommu_probe_device(B)
> iommu_device_group(A) -> lookup returns group X
> ...
> iommu_remove_device(A)
> delete device A
> create device C
> iommu_probe_device(C)
> iommu_device_group(C) -> use-after-free of A
>
> Preserving the logical behaviour here would probably look *something* like
> the mangled diff below, but I haven't thought it through 100%.
Yeah, I think you are right. How about just moving the loop which sets
s2crs[idx].group to arm_smmu_device_group()? In that case I can drop
this patch and leave the group pointer in place.
Regards,
Joerg
Powered by blists - more mailing lists