linux-kernel - [PATCH v2] iommu/mediatek: Fix crash on isr after kexec()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221125-mtk-iommu-v2-0-e168dff7d43e@chromium.org>
Date:   Mon, 28 Nov 2022 23:16:48 +0100
From:   Ricardo Ribalda <ribalda@...omium.org>
To:     Joerg Roedel <joro@...tes.org>,
        Matthias Brugger <matthias.bgg@...il.com>,
        Yong Wu <yong.wu@...iatek.com>, Will Deacon <will@...nel.org>,
        Robin Murphy <robin.murphy@....com>
Cc:     linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org,
        Ricardo Ribalda <ribalda@...omium.org>, iommu@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: [PATCH v2] iommu/mediatek: Fix crash on isr after kexec()

If the system is rebooted via isr(), the IRQ handler might be triggerd
before the domain is initialized. Resulting on an invalid memory access
error.

Fix:
[    0.500930] Unable to handle kernel read from unreadable memory at virtual address 0000000000000070
[    0.501166] Call trace:
[    0.501174]  report_iommu_fault+0x28/0xfc
[    0.501180]  mtk_iommu_isr+0x10c/0x1c0

Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
---
To: Yong Wu <yong.wu@...iatek.com>
To: Joerg Roedel <joro@...tes.org>
To: Will Deacon <will@...nel.org>
To: Robin Murphy <robin.murphy@....com>
To: Matthias Brugger <matthias.bgg@...il.com>
Cc: iommu@...ts.linux.dev
Cc: linux-mediatek@...ts.infradead.org
Cc: linux-arm-kernel@...ts.infradead.org
Cc: linux-kernel@...r.kernel.org
---
Changes in v2:
- Also print the error message if !dom (Thanks Yong)
- Link to v1: https://lore.kernel.org/r/20221125-mtk-iommu-v1-0-bb5ecac97a28@chromium.org
---
 drivers/iommu/mtk_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index 2ab2ecfe01f8..3d913ab5029c 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -454,7 +454,7 @@ static irqreturn_t mtk_iommu_isr(int irq, void *dev_id)
 		fault_larb = data->plat_data->larbid_remap[fault_larb][sub_comm];
 	}
 
-	if (report_iommu_fault(&dom->domain, bank->parent_dev, fault_iova,
+	if (!dom || report_iommu_fault(&dom->domain, bank->parent_dev, fault_iova,
 			       write ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ)) {
 		dev_err_ratelimited(
 			bank->parent_dev,

---
base-commit: 4312098baf37ee17a8350725e6e0d0e8590252d4
change-id: 20221125-mtk-iommu-13023f971298

Best regards,
-- 
Ricardo Ribalda <ribalda@...omium.org>