Skip to content

Commit 18abda7

Browse files
yiliu1765willdeacon
yiliu1765
authored and
willdeacon
committed
iommu/vt-d: Fix general protection fault in aux_detach_device()
The aux-domain attach/detach are not tracked, some data structures might be used after free. This causes general protection faults when multiple subdevices are created and assigned to a same guest machine: | general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] SMP NOPTI | RIP: 0010:intel_iommu_aux_detach_device+0x12a/0x1f0 | [...] | Call Trace: | iommu_aux_detach_device+0x24/0x70 | vfio_mdev_detach_domain+0x3b/0x60 | ? vfio_mdev_set_domain+0x50/0x50 | iommu_group_for_each_dev+0x4f/0x80 | vfio_iommu_detach_group.isra.0+0x22/0x30 | vfio_iommu_type1_detach_group.cold+0x71/0x211 | ? find_exported_symbol_in_section+0x4a/0xd0 | ? each_symbol_section+0x28/0x50 | __vfio_group_unset_container+0x4d/0x150 | vfio_group_try_dissolve_container+0x25/0x30 | vfio_group_put_external_user+0x13/0x20 | kvm_vfio_group_put_external_user+0x27/0x40 [kvm] | kvm_vfio_destroy+0x45/0xb0 [kvm] | kvm_put_kvm+0x1bb/0x2e0 [kvm] | kvm_vm_release+0x22/0x30 [kvm] | __fput+0xcc/0x260 | ____fput+0xe/0x10 | task_work_run+0x8f/0xb0 | do_exit+0x358/0xaf0 | ? wake_up_state+0x10/0x20 | ? signal_wake_up_state+0x1a/0x30 | do_group_exit+0x47/0xb0 | __x64_sys_exit_group+0x18/0x20 | do_syscall_64+0x57/0x1d0 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix the crash by tracking the subdevices when attaching and detaching aux-domains. Fixes: 67b8e02 ("iommu/vt-d: Aux-domain specific domain attach/detach") Co-developed-by: Xin Zeng <xin.zeng@intel.com> Signed-off-by: Xin Zeng <xin.zeng@intel.com> Signed-off-by: Liu Yi L <yi.l.liu@intel.com> Acked-by: Lu Baolu <baolu.lu@linux.intel.com> Link: https://lore.kernel.org/r/1609949037-25291-3-git-send-email-yi.l.liu@intel.com Signed-off-by: Will Deacon <will@kernel.org>
1 parent 9ad9f45 commit 18abda7

2 files changed

Lines changed: 82 additions & 29 deletions

File tree

‎drivers/iommu/intel/iommu.c‎

Lines changed: 71 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1877,6 +1877,7 @@ static struct dmar_domain *alloc_domain(int flags)
18771877
domain->flags |= DOMAIN_FLAG_USE_FIRST_LEVEL;
18781878
domain->has_iotlb_device = false;
18791879
INIT_LIST_HEAD(&domain->devices);
1880+
INIT_LIST_HEAD(&domain->subdevices);
18801881

18811882
return domain;
18821883
}
@@ -2547,7 +2548,7 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu,
25472548
info->iommu = iommu;
25482549
info->pasid_table = NULL;
25492550
info->auxd_enabled = 0;
2550-
INIT_LIST_HEAD(&info->auxiliary_domains);
2551+
INIT_LIST_HEAD(&info->subdevices);
25512552

25522553
if (dev && dev_is_pci(dev)) {
25532554
struct pci_dev *pdev = to_pci_dev(info->dev);
@@ -4475,33 +4476,61 @@ is_aux_domain(struct device *dev, struct iommu_domain *domain)
44754476
domain->type == IOMMU_DOMAIN_UNMANAGED;
44764477
}
44774478

4478-
static void auxiliary_link_device(struct dmar_domain *domain,
4479-
struct device *dev)
4479+
static inline struct subdev_domain_info *
4480+
lookup_subdev_info(struct dmar_domain *domain, struct device *dev)
4481+
{
4482+
struct subdev_domain_info *sinfo;
4483+
4484+
if (!list_empty(&domain->subdevices)) {
4485+
list_for_each_entry(sinfo, &domain->subdevices, link_domain) {
4486+
if (sinfo->pdev == dev)
4487+
return sinfo;
4488+
}
4489+
}
4490+
4491+
return NULL;
4492+
}
4493+
4494+
static int auxiliary_link_device(struct dmar_domain *domain,
4495+
struct device *dev)
44804496
{
44814497
struct device_domain_info *info = get_domain_info(dev);
4498+
struct subdev_domain_info *sinfo = lookup_subdev_info(domain, dev);
44824499

44834500
assert_spin_locked(&device_domain_lock);
44844501
if (WARN_ON(!info))
4485-
return;
4502+
return -EINVAL;
4503+
4504+
if (!sinfo) {
4505+
sinfo = kzalloc(sizeof(*sinfo), GFP_ATOMIC);
4506+
sinfo->domain = domain;
4507+
sinfo->pdev = dev;
4508+
list_add(&sinfo->link_phys, &info->subdevices);
4509+
list_add(&sinfo->link_domain, &domain->subdevices);
4510+
}
44864511

4487-
domain->auxd_refcnt++;
4488-
list_add(&domain->auxd, &info->auxiliary_domains);
4512+
return ++sinfo->users;
44894513
}
44904514

4491-
static void auxiliary_unlink_device(struct dmar_domain *domain,
4492-
struct device *dev)
4515+
static int auxiliary_unlink_device(struct dmar_domain *domain,
4516+
struct device *dev)
44934517
{
44944518
struct device_domain_info *info = get_domain_info(dev);
4519+
struct subdev_domain_info *sinfo = lookup_subdev_info(domain, dev);
4520+
int ret;
44954521

44964522
assert_spin_locked(&device_domain_lock);
4497-
if (WARN_ON(!info))
4498-
return;
4523+
if (WARN_ON(!info || !sinfo || sinfo->users <= 0))
4524+
return -EINVAL;
44994525

4500-
list_del(&domain->auxd);
4501-
domain->auxd_refcnt--;
4526+
ret = --sinfo->users;
4527+
if (!ret) {
4528+
list_del(&sinfo->link_phys);
4529+
list_del(&sinfo->link_domain);
4530+
kfree(sinfo);
4531+
}
45024532

4503-
if (!domain->auxd_refcnt && domain->default_pasid > 0)
4504-
ioasid_put(domain->default_pasid);
4533+
return ret;
45054534
}
45064535

45074536
static int aux_domain_add_dev(struct dmar_domain *domain,
@@ -4530,6 +4559,19 @@ static int aux_domain_add_dev(struct dmar_domain *domain,
45304559
}
45314560

45324561
spin_lock_irqsave(&device_domain_lock, flags);
4562+
ret = auxiliary_link_device(domain, dev);
4563+
if (ret <= 0)
4564+
goto link_failed;
4565+
4566+
/*
4567+
* Subdevices from the same physical device can be attached to the
4568+
* same domain. For such cases, only the first subdevice attachment
4569+
* needs to go through the full steps in this function. So if ret >
4570+
* 1, just goto out.
4571+
*/
4572+
if (ret > 1)
4573+
goto out;
4574+
45334575
/*
45344576
* iommu->lock must be held to attach domain to iommu and setup the
45354577
* pasid entry for second level translation.
@@ -4548,10 +4590,9 @@ static int aux_domain_add_dev(struct dmar_domain *domain,
45484590
domain->default_pasid);
45494591
if (ret)
45504592
goto table_failed;
4551-
spin_unlock(&iommu->lock);
4552-
4553-
auxiliary_link_device(domain, dev);
45544593

4594+
spin_unlock(&iommu->lock);
4595+
out:
45554596
spin_unlock_irqrestore(&device_domain_lock, flags);
45564597

45574598
return 0;
@@ -4560,8 +4601,10 @@ static int aux_domain_add_dev(struct dmar_domain *domain,
45604601
domain_detach_iommu(domain, iommu);
45614602
attach_failed:
45624603
spin_unlock(&iommu->lock);
4604+
auxiliary_unlink_device(domain, dev);
4605+
link_failed:
45634606
spin_unlock_irqrestore(&device_domain_lock, flags);
4564-
if (!domain->auxd_refcnt && domain->default_pasid > 0)
4607+
if (list_empty(&domain->subdevices) && domain->default_pasid > 0)
45654608
ioasid_put(domain->default_pasid);
45664609

45674610
return ret;
@@ -4581,14 +4624,18 @@ static void aux_domain_remove_dev(struct dmar_domain *domain,
45814624
info = get_domain_info(dev);
45824625
iommu = info->iommu;
45834626

4584-
auxiliary_unlink_device(domain, dev);
4585-
4586-
spin_lock(&iommu->lock);
4587-
intel_pasid_tear_down_entry(iommu, dev, domain->default_pasid, false);
4588-
domain_detach_iommu(domain, iommu);
4589-
spin_unlock(&iommu->lock);
4627+
if (!auxiliary_unlink_device(domain, dev)) {
4628+
spin_lock(&iommu->lock);
4629+
intel_pasid_tear_down_entry(iommu, dev,
4630+
domain->default_pasid, false);
4631+
domain_detach_iommu(domain, iommu);
4632+
spin_unlock(&iommu->lock);
4633+
}
45904634

45914635
spin_unlock_irqrestore(&device_domain_lock, flags);
4636+
4637+
if (list_empty(&domain->subdevices) && domain->default_pasid > 0)
4638+
ioasid_put(domain->default_pasid);
45924639
}
45934640

45944641
static int prepare_domain_attach_device(struct iommu_domain *domain,

‎include/linux/intel-iommu.h‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -533,11 +533,10 @@ struct dmar_domain {
533533
/* Domain ids per IOMMU. Use u16 since
534534
* domain ids are 16 bit wide according
535535
* to VT-d spec, section 9.3 */
536-
unsigned int auxd_refcnt; /* Refcount of auxiliary attaching */
537536

538537
bool has_iotlb_device;
539538
struct list_head devices; /* all devices' list */
540-
struct list_head auxd; /* link to device's auxiliary list */
539+
struct list_head subdevices; /* all subdevices' list */
541540
struct iova_domain iovad; /* iova's that belong to this domain */
542541

543542
struct dma_pte *pgd; /* virtual address */
@@ -610,14 +609,21 @@ struct intel_iommu {
610609
struct dmar_drhd_unit *drhd;
611610
};
612611

612+
/* Per subdevice private data */
613+
struct subdev_domain_info {
614+
struct list_head link_phys; /* link to phys device siblings */
615+
struct list_head link_domain; /* link to domain siblings */
616+
struct device *pdev; /* physical device derived from */
617+
struct dmar_domain *domain; /* aux-domain */
618+
int users; /* user count */
619+
};
620+
613621
/* PCI domain-device relationship */
614622
struct device_domain_info {
615623
struct list_head link; /* link to domain siblings */
616624
struct list_head global; /* link to global list */
617625
struct list_head table; /* link to pasid table */
618-
struct list_head auxiliary_domains; /* auxiliary domains
619-
* attached to this device
620-
*/
626+
struct list_head subdevices; /* subdevices sibling */
621627
u32 segment; /* PCI segment number */
622628
u8 bus; /* PCI bus number */
623629
u8 devfn; /* PCI devfn number */

0 commit comments

Comments
 (0)