IOMMU Fixes for Linux v5.17-rc2

Including:
 
 	- Warning fixes and a fix for a potential use-after-free in
 	  IOMMU core code
 
 	- Another potential memory leak fix for the Intel VT-d driver
 
 	- Fix for an IO polling loop timeout issue in the AMD IOMMU
 	  driver
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmH9SlYACgkQK/BELZcB
 GuMDTg/+PSpnvziUKFlRRXWsdRi1RAjYKOAtUTYQ6tc9ja46ywV4ZPocnhDtjwIa
 JiC1KY8Cvsg37QG5Ag23jGTAJhjsDpfX/evTdQj2fjYSK4cmEdnhDRI4GC247d2U
 HXhG/MarvXQO+Utz+n705nglorTA+5KhIhJWqUUYDltMJeqdRSUUfzZhEtb6eyeg
 McObWl5wS8FRLx2dy2xeHjf84L20goEIdI1Tqp487XNHBZ6lnkJkM6Wnm6B3qgdw
 +gTwSSx155WhWtJnXrV9/C3ymq5BrMxc9ORYywCZeIEFV1ACLNjWSUV0RYFHdm1g
 nmE9U2/MH7V9Yx3MIfozB1FoycEDBeE4NZkWqZOqzuQl9bZt9kU+wX/8i6uOQJuO
 ynasKbWdr8WNHT5NYN0wFYHfGTAQXOXsAME7DqwjhN+slxmRyFEsW06Qf/8MmtXe
 t9LXiKs3a8qYieC0HPbg8NKgjkx5taxI11QfYEOrwi8VCU9HswNHggcaGdPI+ZIN
 QpmTKvqLwZCU5rRmy5gZkJb3nFxcCyvo2t7Rqi/poFlwLjuZC2x/Iab/lH5q+jDy
 xnJZZ16RHA5kR1JPjAyT4Y++pd925PxiUAVVuRLvAl1MfYYVAJy4YTwWRqMwRyuG
 NIXnsJuMV5UwMl80S4peRrWBDgwKZYu3u5rZBRb8hgQCbshZwxU=
 =rcwP
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull iommu fixes from Joerg Roedel:

 - Warning fixes and a fix for a potential use-after-free in IOMMU core
   code

 - Another potential memory leak fix for the Intel VT-d driver

 - Fix for an IO polling loop timeout issue in the AMD IOMMU driver

* tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
  iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
  iommu: Fix some W=1 warnings
  iommu: Fix potential use-after-free during probe
This commit is contained in:
Linus Torvalds 2022-02-04 11:45:16 -08:00
commit 07cd9ac4c5
5 changed files with 33 additions and 18 deletions

View File

@ -21,6 +21,7 @@
#include <linux/export.h>
#include <linux/kmemleak.h>
#include <linux/cc_platform.h>
#include <linux/iopoll.h>
#include <asm/pci-direct.h>
#include <asm/iommu.h>
#include <asm/apic.h>
@ -834,6 +835,7 @@ static int iommu_ga_log_enable(struct amd_iommu *iommu)
status = readl(iommu->mmio_base + MMIO_STATUS_OFFSET);
if (status & (MMIO_STATUS_GALOG_RUN_MASK))
break;
udelay(10);
}
if (WARN_ON(i >= LOOP_TIMEOUT))

View File

@ -569,9 +569,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
fn, &intel_ir_domain_ops,
iommu);
if (!iommu->ir_domain) {
irq_domain_free_fwnode(fn);
pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);
goto out_free_bitmap;
goto out_free_fwnode;
}
iommu->ir_msi_domain =
arch_create_remap_msi_irq_domain(iommu->ir_domain,
@ -595,7 +594,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
if (dmar_enable_qi(iommu)) {
pr_err("Failed to enable queued invalidation\n");
goto out_free_bitmap;
goto out_free_ir_domain;
}
}
@ -619,6 +618,14 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
return 0;
out_free_ir_domain:
if (iommu->ir_msi_domain)
irq_domain_remove(iommu->ir_msi_domain);
iommu->ir_msi_domain = NULL;
irq_domain_remove(iommu->ir_domain);
iommu->ir_domain = NULL;
out_free_fwnode:
irq_domain_free_fwnode(fn);
out_free_bitmap:
bitmap_free(bitmap);
out_free_pages:

View File

@ -349,6 +349,7 @@ EXPORT_SYMBOL_GPL(ioasid_alloc);
/**
* ioasid_get - obtain a reference to the IOASID
* @ioasid: the ID to get
*/
void ioasid_get(ioasid_t ioasid)
{

View File

@ -207,9 +207,14 @@ static struct dev_iommu *dev_iommu_get(struct device *dev)
static void dev_iommu_free(struct device *dev)
{
iommu_fwspec_free(dev);
kfree(dev->iommu);
struct dev_iommu *param = dev->iommu;
dev->iommu = NULL;
if (param->fwspec) {
fwnode_handle_put(param->fwspec->iommu_fwnode);
kfree(param->fwspec);
}
kfree(param);
}
static int __iommu_probe_device(struct device *dev, struct list_head *group_list)
@ -980,17 +985,6 @@ static int iommu_group_device_count(struct iommu_group *group)
return ret;
}
/**
* iommu_group_for_each_dev - iterate over each device in the group
* @group: the group
* @data: caller opaque data to be passed to callback function
* @fn: caller supplied callback function
*
* This function is called by group users to iterate over group devices.
* Callers should hold a reference count to the group during callback.
* The group->mutex is held across callbacks, which will block calls to
* iommu_group_add/remove_device.
*/
static int __iommu_group_for_each_dev(struct iommu_group *group, void *data,
int (*fn)(struct device *, void *))
{
@ -1005,7 +999,17 @@ static int __iommu_group_for_each_dev(struct iommu_group *group, void *data,
return ret;
}
/**
* iommu_group_for_each_dev - iterate over each device in the group
* @group: the group
* @data: caller opaque data to be passed to callback function
* @fn: caller supplied callback function
*
* This function is called by group users to iterate over group devices.
* Callers should hold a reference count to the group during callback.
* The group->mutex is held across callbacks, which will block calls to
* iommu_group_add/remove_device.
*/
int iommu_group_for_each_dev(struct iommu_group *group, void *data,
int (*fn)(struct device *, void *))
{
@ -3032,6 +3036,7 @@ EXPORT_SYMBOL_GPL(iommu_aux_get_pasid);
* iommu_sva_bind_device() - Bind a process address space to a device
* @dev: the device
* @mm: the mm to bind, caller must hold a reference to it
* @drvdata: opaque data pointer to pass to bind callback
*
* Create a bond between device and address space, allowing the device to access
* the mm using the returned PASID. If a bond already exists between @device and

View File

@ -1085,7 +1085,7 @@ static __maybe_unused int omap_iommu_runtime_resume(struct device *dev)
}
/**
* omap_iommu_suspend_prepare - prepare() dev_pm_ops implementation
* omap_iommu_prepare - prepare() dev_pm_ops implementation
* @dev: iommu device
*
* This function performs the necessary checks to determine if the IOMMU