linux-kernel - Re: [PATCH] iommu/amd: Fix iommu remap panic while amd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210317104656.GA2508995@hr-amd>
Date:   Wed, 17 Mar 2021 18:46:56 +0800
From:   Huang Rui <ray.huang@....com>
To:     Joerg Roedel <jroedel@...e.de>
Cc:     "iommu@...ts.linux-foundation.org" <iommu@...ts.linux-foundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Joerg Roedel <joro@...tes.org>,
        "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@....com>,
        "Deucher, Alexander" <Alexander.Deucher@....com>,
        "Du, Xiaojian" <Xiaojian.Du@....com>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH] iommu/amd: Fix iommu remap panic while amd_iommu is set
 to disable

On Tue, Mar 16, 2021 at 11:00:26PM +0800, Joerg Roedel wrote:
> On Tue, Mar 16, 2021 at 09:36:02PM +0800, Huang Rui wrote:
> > Thanks for the comments. Could you please elaborate this?
> > 
> > Do you mean while amd_iommu=off, we won't prepare the IVRS, and even
> > needn't get all ACPI talbes. Because they are never be used and the next
> > state will always goes into IOMMU_CMDLINE_DISABLED, am I right?
> 
> The first problem was that amd_iommu_irq_remap is never set back to
> false when irq-remapping initialization fails in amd_iommu_prepare().
> 
> But there are other problems, like that even when the IOMMU is set to
> disabled on the command line with amd_iommu=off, the code still sets up
> all IOMMUs and registers IRQ domains for them.
> 

Yes, that was the problem I found in my side. No very clear about the
orignal intention. But if you said this is a problem, that makes sense...

> Later the code checks wheter the IOMMU should stay disabled and tears
> everything down, except for the IRQ domains, which stay in the global
> list.
> 
> The APIs do not really support tearing down IRQ domains well, so its not
> so easy to add this to the tear-down path. Now that the IRQ domains stay
> in the list, the ACPI code will come along later and calls the
> ->select() call-back for every IRQ domain, which gets execution to
> irq_remapping_select(), depite IOMMU being disabled and
> amd_iommu_rlookup_table already de-allocated. But since
> amd_iommu_irq_remap is still true the NULL pointer is dereferenced,
> causing the crash.

OK. We found some memleaks here before as well. It looks cause by iommu data
buffer initialization and not be cleared. And yes, if setup iommu here, it
actually causes many issues.

unreferenced object 0xffff888332047500 (size 224):
  comm "swapper/0", pid 0, jiffies 4294892296 (age 362.192s)
  hex dump (first 32 bytes):
    b0 22 03 00 00 00 00 00 00 00 00 40 00 00 00 00  .".........@....
    06 00 00 00 00 00 00 00 00 20 00 00 00 20 00 00  ......... ... ..
  backtrace:
    [<000000008f162024>] kmem_cache_alloc+0x145/0x440
    [<00000000420093ba>] kmem_cache_create_usercopy+0x127/0x2c0
    [<00000000f5ed7ff0>] kmem_cache_create+0x16/0x20
    [<000000004c1e4f47>] iommu_go_to_state+0x8e4/0x165d
    [<00000000a191b705>] amd_iommu_prepare+0x1a/0x2f
    [<00000000afe5b97e>] irq_remapping_prepare+0x35/0x6d
    [<00000000209f36b5>] enable_IR_x2apic+0x2b/0x1ae
    [<00000000b64491b5>] default_setup_apic_routing+0x16/0x65
    [<00000000e89c64a1>] apic_intr_mode_init+0x81/0x10a
    [<00000000eaa14bf6>] x86_late_time_init+0x24/0x35
    [<00000000e291fc71>] start_kernel+0x509/0x5c7
    [<0000000099930dfe>] x86_64_start_reservations+0x24/0x26
    [<00000000b369765d>] x86_64_start_kernel+0x75/0x79
    [<000000004f411919>] secondary_startup_64_no_verify+0xb0/0xbb

> 
> When the IRQ domains would not be around, this would also not happen. So
> my patches also change the initializtion to not do all the setup work
> when amd_iommu=off was passed on the command line.
> 

Thanks for the fix and explaination. :-)

Best Regards,
Ray