Received-SPF: pass (google.com: domain of linux-kernel+bounces-14727-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Date: Tue, 2 Jan 2024 14:44:22 -0400
From: Jason Gunthorpe <jgg@nvidia.com>
To: Yi Liu <yi.l.liu@intel.com>
Cc: joro@8bytes.org, alex.williamson@redhat.com, kevin.tian@intel.com,
	robin.murphy@arm.com, baolu.lu@linux.intel.com, cohuck@redhat.com,
	eric.auger@redhat.com, nicolinc@nvidia.com, kvm@vger.kernel.org,
	mjrosato@linux.ibm.com, chao.p.peng@linux.intel.com,
	yi.y.sun@linux.intel.com, peterx@redhat.com, jasowang@redhat.com,
	shameerali.kolothum.thodi@huawei.com, lulu@redhat.com,
	suravee.suthikulpanit@amd.com, iommu@lists.linux.dev,
	linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
	zhenzhong.duan@intel.com, joao.m.martins@oracle.com,
	xin.zeng@intel.com, yan.y.zhao@intel.com, j.granados@samsung.com
Subject: Re: [PATCH v10 10/10] iommu/vt-d: Add iotlb flush for nested domain
Message-ID: <20240102184422.GI50406@nvidia.com>
References: <20240102143834.146165-1-yi.l.liu@intel.com>
 <20240102143834.146165-11-yi.l.liu@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240102143834.146165-11-yi.l.liu@intel.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?Dj1DT6kWlSjz4pzIVcaZTv7bX8aoyqMDADeSg1uTcEXwEcw8ZWXDyrBI5VXa?=
 =?us-ascii?Q?qPu/BkKPQU0X7RWH9tuVTFzA8mBo7eNVxl+59b7BiFfIw/Q5OCeKCAE3Bttf?=
 =?us-ascii?Q?br9XJusAqvh1NQW592EBKbPwwA3oYUBIIiU+u2aGWAcGLXVlIeDu5YAXucXr?=
 =?us-ascii?Q?kXCPDz2cO9qdMaWFojMh7ph6ZEbLNUyXMR4YthMn8MpsXLbSc0dm6X4iiuBP?=
 =?us-ascii?Q?/iNXfPp6q/0M1oNNGbhpvpMG5BrOamgQVxMcYOD/SRACVmBr/Kp6MyiMCfd0?=
 =?us-ascii?Q?wpxT7lzPcRbUoRTOuCxmiHbVyE8zuoAe9zz5VfUZMeZJWyFK318eoBn5aWAG?=
 =?us-ascii?Q?Ts26c4m+/W1RxlADLu5UEath0qdzMZYRnYidJJEHLlJxwL5t2MY/dYPamb8b?=
 =?us-ascii?Q?bUzF61SHuWRzlG7PQLYJloLTjKT7PRdNpT7oAooKAXGNmcRnWjZNP3Jsqr4x?=
 =?us-ascii?Q?Sd7wl0FolsuZJ23rb/tkHChY4RWVhGTTtQScihItEgn+/ipOtjoBCqMxc4K+?=
 =?us-ascii?Q?4DF4Cpz+fE+3oXvssMjKiNPjD77FXy1Y7usFgHMQKBMb+DOsjhaPcc92ja+8?=
 =?us-ascii?Q?87/Mz359088n5bvJtA7BxHUOpOWTk3O3ueK7hX2WEU8CXO/1H1gge3m8+MKJ?=
 =?us-ascii?Q?nIN0J8QhfJ1fFX3/smI2x5qOsgRboW7V89Q8jpzhRLq/f92mp5wVb6ZzlAt2?=
 =?us-ascii?Q?okgAn617S1A3olJ8fq9Q2Fohwy/QuCMrWqiI0lrE6WLvIUDnWueE8CdVqCD2?=
 =?us-ascii?Q?K9DmmAfP8thcxBM55dJzRF65ijssnMA4qPdCONFNXaSoO63rrgkTpUvDV65G?=
 =?us-ascii?Q?8YfIlbEwUdu8jA34E9vmV7aTAw+gQK0T1u9b6tusawqO1efzsaehU89u6wGy?=
 =?us-ascii?Q?YwpHktvNVMP2eW2DaG7K+EpBcEyLEz3rPnU6BvD21yIFEzMhMU4/vp7emufw?=
 =?us-ascii?Q?pgcBTF3ofi5GJSnOLlH2f6wrjXOVSHBHrKjxXUMGBuPq8J5e9P5lS0JO9LRL?=
 =?us-ascii?Q?9XqqDqbF2/pzQZ9eeBE6dlbpyu8B/QVnsb3n7YN+8f46pKgfNBWnO7ZXhh2l?=
 =?us-ascii?Q?8SedaMb3ar3izXKq8GsJ9cs7ROcS7xJqyOdyuMQjPmNfHduDNAil+Hyi8kCz?=
 =?us-ascii?Q?Ae84XfIWJzY1bC2gbavo6ncC4er+ZXDyeCzMHhPIJ9EcfCj9dhMiEYqmosXm?=
 =?us-ascii?Q?G8J9phzbAau4tyPE9Q/LVNaLtcUFWixY73o5QKp/xE4kgJ51X3MwsrYpQk9Z?=
 =?us-ascii?Q?WfLFXjOkcb2giCoiLK4HKPcy2HzWovpWKi+MXZw66cA9ROvLIJGH2YGjC2tm?=
 =?us-ascii?Q?JoaN//hb8OdGAofSVJo9cGOUPkWhsihHcaHp3hLX1bIqnjuZaPODMDWCIptm?=
 =?us-ascii?Q?Gyx2L4KwXfT7xKoFjec9QSWqQu5aqaNOZ+FYErv40bFtWb0ETkk8UF0L4li0?=
 =?us-ascii?Q?1KPGDxgKVFhfzmXjNJsKIFjEU56NNxKD9Q2zs0zpm/8oJlS3PtFCf5BzDjqJ?=
 =?us-ascii?Q?zyMVTa9fEOENl2CmxYCO8nigWd5hrtejadbJGmX1vcvsWp823NHOKXsgm8La?=
 =?us-ascii?Q?GE1QzVGHaVD4dPatpe0=3D?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: aa461738-ed0f-4a01-0336-08dc0bc2d693
X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jan 2024 18:44:23.2631
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: z94V1Tht54g9MrOUXZFey1OuECFS1lqEQYPfDy2KrulGo11dVOl8ifWkzfv1Xych
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB6397

On Tue, Jan 02, 2024 at 06:38:34AM -0800, Yi Liu wrote:

> +static void intel_nested_flush_cache(struct dmar_domain *domain, u64 addr,
> +				     unsigned long npages, bool ih, u32 *error)
> +{
> +	struct iommu_domain_info *info;
> +	unsigned long i;
> +	unsigned mask;
> +	u32 fault;
> +
> +	xa_for_each(&domain->iommu_array, i, info)
> +		qi_flush_piotlb(info->iommu,
> +				domain_id_iommu(domain, info->iommu),
> +				IOMMU_NO_PASID, addr, npages, ih, NULL);

This locking on the xarray is messed up throughout the driver. There
could be a concurrent detach at this point which will free info and
UAF this.

This seems to be systemic issue, so I'm going to ignore it here, but
please make a series to fix it completely.

xarray is probably a bad data structure to manage attachment, a linked
list is going to use less memory in most cases and you need a mutex
lock anyhow.

Jason