linux-kernel - [PATCH v4 01/16] iommu/vt-d: Handle race between registration and device probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Aug 2022 17:20:02 +0100
From:   Robin Murphy <robin.murphy@....com>
To:     joro@...tes.org
Cc:     will@...nel.org, iommu@...ts.linux.dev,
        linux-arm-kernel@...ts.infradead.org, baolu.lu@...ux.intel.com,
        kevin.tian@...el.com, suravee.suthikulpanit@....com,
        vasant.hegde@....com, mjrosato@...ux.ibm.com,
        schnelle@...ux.ibm.com, linux-kernel@...r.kernel.org
Subject: [PATCH v4 01/16] iommu/vt-d: Handle race between registration and device probe

Currently we rely on registering all our instances before initially
allowing any .probe_device calls via bus_set_iommu(). In preparation for
phasing out the latter, make sure we won't inadvertently return success
for a device associated with a known but not yet registered instance,
otherwise we'll run straight into iommu_group_get_for_dev() trying to
use NULL ops.

That also highlights an issue with intel_iommu_get_resv_regions() taking
dmar_global_lock from within a section where intel_iommu_init() already
holds it, which already exists via probe_acpi_namespace_devices() when
an ANDD device is probed, but gets more obvious with the upcoming change
to iommu_device_register(). Since they are both read locks it manages
not to deadlock in practice, and a more in-depth rework of this locking
is underway, so no attempt is made to address it here.

Reviewed-by: Kevin Tian <kevin.tian@...el.com>
Signed-off-by: Robin Murphy <robin.murphy@....com>
---

v4: Update commit message

 drivers/iommu/intel/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 7cca030a508e..65c340e2003c 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -4449,7 +4449,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
 	u8 bus, devfn;

 	iommu = device_to_iommu(dev, &bus, &devfn);
-	if (!iommu)
+	if (!iommu || !iommu->iommu.ops)
 		return ERR_PTR(-ENODEV);

 	info = kzalloc(sizeof(*info), GFP_KERNEL);
-- 
2.36.1.dirty