linux-kernel - Re: [PATCH V2] iommu: Don't reserve 0-length IOVA region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 19 Dec 2023 11:12:16 +0000
From: Robin Murphy <robin.murphy@....com>
To: Ashish Mhetre <amhetre@...dia.com>, joro@...tes.org, will@...nel.org,
 treding@...dia.com
Cc: iommu@...ts.linux.dev, linux-kernel@...r.kernel.org,
 linux-tegra@...r.kernel.org
Subject: Re: [PATCH V2] iommu: Don't reserve 0-length IOVA region

On 2023-12-05 6:56 am, Ashish Mhetre wrote:
> When the bootloader/firmware doesn't setup the framebuffers, their
> address and size are 0 in "iommu-addresses" property. If IOVA region is
> reserved with 0 length, then it ends up corrupting the IOVA rbtree with
> an entry which has pfn_hi < pfn_lo.
> If we intend to use display driver in kernel without framebuffer then
> it's causing the display IOMMU mappings to fail as entire valid IOVA
> space is reserved when address and length are passed as 0.
> An ideal solution would be firmware removing the "iommu-addresses"
> property and corresponding "memory-region" if display is not present.
> But the kernel should be able to handle this by checking for size of
> IOVA region and skipping the IOVA reservation if size is 0. Also, add
> a warning if firmware is requesting 0-length IOVA region reservation.

Acked-by: Robin Murphy <robin.murphy@....com>

> Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()")
> Signed-off-by: Ashish Mhetre <amhetre@...dia.com>
> ---
>   drivers/iommu/of_iommu.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
> index 47302b637cc0..42cffb0ee5e2 100644
> --- a/drivers/iommu/of_iommu.c
> +++ b/drivers/iommu/of_iommu.c
> @@ -264,6 +264,10 @@ void of_iommu_get_resv_regions(struct device *dev, struct list_head *list)
>   					prot |= IOMMU_CACHE;
>   
>   				maps = of_translate_dma_region(np, maps, &iova, &length);
> +				if (length == 0) {
> +					dev_warn(dev, "Cannot reserve IOVA region of 0 size\n");
> +					continue;
> +				}
>   				type = iommu_resv_region_get_type(dev, &phys, iova, length);
>   
>   				region = iommu_alloc_resv_region(iova, length, prot, type,