Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 7 Jun 2023 13:40:37 -0600
From:   Alex Williamson <alex.williamson@redhat.com>
To:     Sidhartha Kumar <sidhartha.kumar@oracle.com>
Cc:     linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
        khalid.aziz@oracle.com
Subject: Re: [PATCH] vfio/iommu_type1: acquire iommu lock in
 vfio_iommu_type1_release()
Message-ID: <20230607134037.6d81e288.alex.williamson@redhat.com>
In-Reply-To: <20230607190752.216801-1-sidhartha.kumar@oracle.com>
References: <20230607190752.216801-1-sidhartha.kumar@oracle.com>
Organization: Red Hat
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Wed,  7 Jun 2023 12:07:52 -0700
Sidhartha Kumar <sidhartha.kumar@oracle.com> wrote:

> From vfio_iommu_type1_release() there is a code path:
> 
> vfio_iommu_unmap_unpin_all()
>  vfio_remove_dma()
>     vfio_unmap_unpin()
>       unmap_unpin_slow()
>         vfio_unpin_pages_remote()
>           vfio_find_vpfn()
> 
> This path is taken without acquiring the iommu lock so it could lead to
> a race condition in the traversal of the pfn_list rb tree.

What's the competing thread for the race, vfio_remove_dma() tests:

	WARN_ON(!RB_EMPTY_ROOT(&dma->pfn_list));

The fix is not unreasonable, but is this a theoretical fix upstream
that's tickled by some downstream additions, or are we actually
competing against page pinning by an mdev driver after the container is
released?  Thanks,

Alex

> The lack of
> the iommu lock in vfio_iommu_type1_release() was confirmed by adding a
> 
> WARN_ON(!mutex_is_locked(&iommu->lock))
> 
> which was reported in dmesg. Fix this potential race by adding a iommu
> lock and release in vfio_iommu_type1_release().
> 
> Suggested-by: Khalid Aziz <khalid.aziz@oracle.com>
> Signed-off-by: Sidhartha Kumar <sidhartha.kumar@oracle.com>
> ---
>  drivers/vfio/vfio_iommu_type1.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index 306e6f1d1c70e..7d2fea1b483dc 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -2601,7 +2601,9 @@ static void vfio_iommu_type1_release(void *iommu_data)
>  		kfree(group);
>  	}
>  
> +	mutex_lock(&iommu->lock);
>  	vfio_iommu_unmap_unpin_all(iommu);
> +	mutex_unlock(&iommu->lock);
>  
>  	list_for_each_entry_safe(domain, domain_tmp,
>  				 &iommu->domain_list, next) {