linux-kernel - Re: [PATCH v2 4/4] drivers/iommu-debug-pagealloc: Check mapped/unmapped kernel memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aSRR2h68l9LRn3iZ@google.com>
Date: Mon, 24 Nov 2025 12:38:50 +0000
From: Mostafa Saleh <smostafa@...gle.com>
To: Will Deacon <will@...nel.org>
Cc: linux-mm@...ck.org, iommu@...ts.linux.dev, linux-kernel@...r.kernel.org,
	linux-doc@...r.kernel.org, corbet@....net, joro@...tes.org,
	robin.murphy@....com, akpm@...ux-foundation.org, vbabka@...e.cz,
	surenb@...gle.com, mhocko@...e.com, jackmanb@...gle.com,
	hannes@...xchg.org, ziy@...dia.com, david@...hat.com,
	lorenzo.stoakes@...cle.com, Liam.Howlett@...cle.com,
	rppt@...nel.org, Qinxin Xia <xiaqinxin@...wei.com>
Subject: Re: [PATCH v2 4/4] drivers/iommu-debug-pagealloc: Check
 mapped/unmapped kernel memory

On Thu, Nov 13, 2025 at 10:59:57AM +0000, Will Deacon wrote:
> On Thu, Nov 06, 2025 at 04:39:53PM +0000, Mostafa Saleh wrote:
> > Now, as the page_ext holds count of IOMMU mappings, we can use it to
> > assert that any page allocated/freed is indeed not in the IOMMU.
> > 
> > The sanitizer doesn’t protect against mapping/unmapping during this
> > period. However, that’s less harmful as the page is not used by the
> > kernel.
> > 
> > Signed-off-by: Mostafa Saleh <smostafa@...gle.com>
> > Tested-by: Qinxin Xia <xiaqinxin@...wei.com>
> > ---
> >  drivers/iommu/iommu-debug-pagealloc.c | 19 +++++++++++++++++++
> >  include/linux/iommu-debug-pagealloc.h | 12 ++++++++++++
> >  include/linux/mm.h                    |  5 +++++
> >  3 files changed, 36 insertions(+)
> > 
> > diff --git a/drivers/iommu/iommu-debug-pagealloc.c b/drivers/iommu/iommu-debug-pagealloc.c
> > index 0e14104b971c..5b26c84d3a0e 100644
> > --- a/drivers/iommu/iommu-debug-pagealloc.c
> > +++ b/drivers/iommu/iommu-debug-pagealloc.c
> > @@ -71,6 +71,25 @@ static size_t iommu_debug_page_size(struct iommu_domain *domain)
> >  	return 1UL << __ffs(domain->pgsize_bitmap);
> >  }
> >  
> > +static unsigned int iommu_debug_page_count(unsigned long phys)
> 
> 'phys_addr_t phys' ?
> 
> But having said that, wouldn't you be better off taking the
> 'struct page *' here rather than converting it to a physical address
> only for get_iommu_page_ext() to convert it straight back again?

Will do, we will need the physical address anyway for the error message.

> 
> > +{
> > +	unsigned int ref;
> > +	struct page_ext *page_ext = get_iommu_page_ext(phys);
> > +	struct iommu_debug_metadate *d = get_iommu_data(page_ext);
> > +
> > +	ref = atomic_read(&d->ref);
> > +	page_ext_put(page_ext);
> > +	return ref;
> > +}
> > +
> > +void __iommu_debug_check_unmapped(const struct page *page, int numpages)
> > +{
> > +	while (numpages--) {
> > +		WARN_ON(iommu_debug_page_count(page_to_phys(page)));
> 
> Since you only care about the count being non-zero, perhaps tweak
> iommu_debug_page_count() to be something like:
> 
> 	bool iommu_debug_page_referenced(struct page *);
> 

Will do.

Thanks,
Mostafa


> Will