Received-SPF: pass (google.com: domain of linux-kernel+bounces-82813-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
From: "Tian, Kevin" <kevin.tian@intel.com>
To: Lu Baolu <baolu.lu@linux.intel.com>, Joerg Roedel <joro@8bytes.org>, "Will
 Deacon" <will@kernel.org>, Robin Murphy <robin.murphy@arm.com>, "Jason
 Gunthorpe" <jgg@ziepe.ca>, "Badger, Eric" <ebadger@purestorage.com>
CC: "iommu@lists.linux.dev" <iommu@lists.linux.dev>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH 2/2] iommu/vt-d: Fix NULL domain on device release
Thread-Topic: [PATCH 2/2] iommu/vt-d: Fix NULL domain on device release
Thread-Index: AQHaZhfXSwaK0zWAdEOfbi7sTGWj9LEd0iRA
Date: Tue, 27 Feb 2024 07:40:29 +0000
Message-ID: <BN9PR11MB52763D19A01C804FB514419F8C592@BN9PR11MB5276.namprd11.prod.outlook.com>
References: <20240223051302.177596-1-baolu.lu@linux.intel.com>
 <20240223051302.177596-3-baolu.lu@linux.intel.com>
In-Reply-To: <20240223051302.177596-3-baolu.lu@linux.intel.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?158T2Ighs3zO7+G48cMGGnSW/SSvep8+7Q9O+lF1s2c/mar7Xz/3BRf/vj0t?=
 =?us-ascii?Q?LSffWT/ZtObiLU+njEvjYLVEfvh/ZmkGKNl8HWUBl6pyAXnr4TfFZgS1jpQs?=
 =?us-ascii?Q?yK0eOyzmN/xVO+h2Qr/ujOiewgKVd6+NZwPHw3Z/8z5YQYrNIV1uix0Qdk86?=
 =?us-ascii?Q?rEJQ1bP0fkRa/BcfTZNSEz+t3rX9JFjQUDKlxPwotgV4H7crfhirD6cPYZpq?=
 =?us-ascii?Q?PjAlM5Cwc0I4nf7J0+WnmRKH2IXYa+U2bSEIxyfQda2MgqXfQeWVVfZFQ5Ha?=
 =?us-ascii?Q?8FXqj8S9OGHM8psNn3r23CtGkMf4zVRSaGqxnLSrjg1S0+YzgyM5IyJWlzV3?=
 =?us-ascii?Q?t9Qbbgm+7LHeV8X8biv0EYsCRxffAykcz3vDxPOBhMK7oStK8fx+vqhIjHB1?=
 =?us-ascii?Q?vahe14ZGa6FyCwMbZPJ585+RJNHJ9BAGmqKP/jb89cZKjuWO3vnsZOeHtogk?=
 =?us-ascii?Q?b4teXrgbpMfuXcfhOSxdnyVYioQej1QpM4mFyqegfCyJLie7atcGoh9HlduF?=
 =?us-ascii?Q?cZC/9Cwl6tMwwmHIbc4Nk9O6o9NWxOIuIr2GBUs6hy+iigj6My5hiuYnbvMr?=
 =?us-ascii?Q?cb0dcxwBtqhSArwdVNkGRmJHjImm3HaxBhtLUYDftj+XFp8gjr8uRMZ2nxsY?=
 =?us-ascii?Q?4IhqwGrwL7UxSIc75xDCyvH64oPn9wPqcOVlqEStwAyIEilnR1pA2SKk7Tex?=
 =?us-ascii?Q?NSia/q4uTphsF61txcEQY5FjxKYbKmKOb3HwH3Z49xzdMZAzXcGsBWLAi10M?=
 =?us-ascii?Q?YqHWtq27V+JxFy7glzl95hlulbxPpwiVg7XCJwPzdbTyvyT8WGbCYY6o/hWH?=
 =?us-ascii?Q?L9aH8/0Ap73PdYAiCI8gpAQ1lEwwhDNXmK8IzG8KYcWoO765hQBemcuebnTz?=
 =?us-ascii?Q?8MihoYD70/9ZlEVtn5Z1zlwsA1ldhm8rKHu0qE0JZ1dXhAMB5Gd76xYHMC/B?=
 =?us-ascii?Q?LRUM5yjutFfcvGjLjKoI/CBwywneMFum9mrcdd7HO1znXiK8YkLiNsA20hDX?=
 =?us-ascii?Q?ldS7rpkLea4jFelQ//K7Ln0HpzenjQO4vH4dnemmTWZAaW3J/thTxwyk6SeF?=
 =?us-ascii?Q?lCuFPT9ABT2IfD6L2KMGY8aSxxzVlJFhcl8gKbzhjfYTJQnrwbjcET9U2bKh?=
 =?us-ascii?Q?Vza2yvsEc3W9jY1uH0+dSvGVudqBeNXgVrgVD8LoAyLcURXvKPP0IktmSzyN?=
 =?us-ascii?Q?wxuT6HZznipskfcuaLm1zWHjER9Obe3X8QJSXAkF+KHjvCjX4L0RS3PZ+nNO?=
 =?us-ascii?Q?RtVJlGNKQt8lU+5dQmHeXYocSO/K2+YIBXMCTFk/t/1AImpm4ZYKjzjeTTWn?=
 =?us-ascii?Q?D3i2kPzPomd2BKtYaCAfvjdtanBQwZBKpsvZV+T22PVYzmVSSwpeXAE4A9yG?=
 =?us-ascii?Q?1IyxkepFv5+Qu/dZmJsx1bU8WvNrA5fgZOGPWSKLA8bImgSJHru9aJE12Y2X?=
 =?us-ascii?Q?w0ND1n3Hfa4mFeAHyHKJO7kdHg2ihiKX0RlxaSwNhtKnwLpOTs35FVP5emn/?=
 =?us-ascii?Q?JGEO/SiWJr0eW5X0HDX4rquY0q52HllKG4LEWT7tJztp+uLggAPZvLw5BtoE?=
 =?us-ascii?Q?r8eiQcnomtp1jWXxj5JdJI0BcKb7hBDB1NQ/ckQM?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN9PR11MB5276.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c0964d8a-2b4a-46ab-8f1c-08dc37675f11
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Feb 2024 07:40:29.5805
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: BLFChK3qW/Cy+cAO5YdmDFAjwf6TI51JZRvOMYg3nSsgkfzF2xpgqjB96S0lMgUCyOzUyfKW2jnFvbhPLwJh4A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4616
X-OriginatorOrg: intel.com

> From: Lu Baolu <baolu.lu@linux.intel.com>
> Sent: Friday, February 23, 2024 1:13 PM
>=20
> -static void dmar_remove_one_dev_info(struct device *dev)
> -{
> -	struct device_domain_info *info =3D dev_iommu_priv_get(dev);
> -	struct dmar_domain *domain =3D info->domain;
> -	struct intel_iommu *iommu =3D info->iommu;
> -	unsigned long flags;
> -
> -	if (!dev_is_real_dma_subdevice(info->dev)) {
> -		if (dev_is_pci(info->dev) && sm_supported(iommu))
> -			intel_pasid_tear_down_entry(iommu, info->dev,
> -					IOMMU_NO_PASID, false);
> -
> -		iommu_disable_pci_caps(info);
> -		domain_context_clear(info);
> -	}
> -
> -	spin_lock_irqsave(&domain->lock, flags);
> -	list_del(&info->link);
> -	spin_unlock_irqrestore(&domain->lock, flags);
> -
> -	domain_detach_iommu(domain, iommu);
> -	info->domain =3D NULL;
> -}
> -

what's required here is slightly different from device_block_translation()
which leaves context entry uncleared in scalable mode (implying the
pasid table must be valid). but in the release path the pasid table will
be freed right after then leading to a use-after-free case.

let's add an explicit domain_context_clear() in intel_iommu_release_device(=
).

with that,

Reviewed-by: Kevin Tian <kevin.tian@intel.com>