linux-kernel - Re: [PATCH v4 2/7] iommufd: Add iommufd_object_tombstone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aHAPqdZKfdeEMDs2@Asurada-Nvidia>
Date: Thu, 10 Jul 2025 12:08:25 -0700
From: Nicolin Chen <nicolinc@...dia.com>
To: Xu Yilun <yilun.xu@...ux.intel.com>
CC: <jgg@...dia.com>, <jgg@...pe.ca>, <kevin.tian@...el.com>,
	<will@...nel.org>, <aneesh.kumar@...nel.org>, <iommu@...ts.linux.dev>,
	<linux-kernel@...r.kernel.org>, <joro@...tes.org>, <robin.murphy@....com>,
	<shuah@...nel.org>, <aik@....com>, <dan.j.williams@...el.com>,
	<baolu.lu@...ux.intel.com>, <yilun.xu@...el.com>
Subject: Re: [PATCH v4 2/7] iommufd: Add iommufd_object_tombstone_user()
 helper

On Wed, Jul 09, 2025 at 12:02:29PM +0800, Xu Yilun wrote:
> Add the iommufd_object_tombstone_user() helper, which allows the caller
> to destroy an iommufd object created by userspace.
> 
> This is useful on some destroy paths when the kernel caller finds the
> object should have been removed by userspace but is still alive. With
> this helper, the caller destroys the object but leave the object ID
> reserved (so called tombstone). The tombstone prevents repurposing the
> object ID without awareness of the original user.
> 
> Since this happens for abnormal userspace behavior, for simplicity, the
> tombstoned object ID would be permanently leaked until
> iommufd_fops_release(). I.e. the original user gets an error when
> calling ioctl(IOMMU_DESTROY) on that ID.
> 
> The first use case would be to ensure the iommufd_vdevice can't outlive
> the associated iommufd_device.
> 
> Suggested-by: Jason Gunthorpe <jgg@...dia.com>
> Reviewed-by: Lu Baolu <baolu.lu@...ux.intel.com>
> Co-developed-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@...nel.org>
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@...nel.org>
> Signed-off-by: Xu Yilun <yilun.xu@...ux.intel.com>

Reviewed-by: Nicolin Chen <nicolinc@...dia.com>

With one nit:

> -	while (!xa_empty(&ictx->objects)) {
> +	for (;;) {
>  		unsigned int destroyed = 0;
>  		unsigned long index;
> +		bool empty = true;
>  
> +		/*
> +		 * xa_for_each() will not return tomestones (zeroed entries),
> +		 * which prevent the xarray being empty. So use an empty flags

Since the first "empty" and the second "empty" are different things,

> +		 * instead of xa_empty() to indicate all entries are either
> +		 * NULLed or tomestoned.
> +		 */

let's write something like this (correcting typos too):

		/*
		 * We can't use xa_empty(), as a tombstone (NULLed entry) would
		 * prevent it returning true, unlike xa_for_each() ignoring the
		 * NULLed entries. So use an empty flag instead of xa_empty() to
		 * indicate all entries are either NULLed or tombstoned.
		 */