From nobody Thu Apr 9 10:54:35 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03BEEC433FE for ; Fri, 4 Nov 2022 19:51:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229636AbiKDTvy (ORCPT ); Fri, 4 Nov 2022 15:51:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229532AbiKDTvv (ORCPT ); Fri, 4 Nov 2022 15:51:51 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 7F9D22CDC0 for ; Fri, 4 Nov 2022 12:51:50 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4A0371FB; Fri, 4 Nov 2022 12:51:56 -0700 (PDT) Received: from e121345-lin.cambridge.arm.com (e121345-lin.cambridge.arm.com [10.1.196.40]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 216DD3F5A1; Fri, 4 Nov 2022 12:51:48 -0700 (PDT) From: Robin Murphy To: joro@8bytes.org Cc: will@kernel.org, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Brian Norris Subject: [PATCH] iommu: Avoid races around device probe Date: Fri, 4 Nov 2022 19:51:43 +0000 Message-Id: <1946ef9f774851732eed78760a78ec40dbc6d178.1667591503.git.robin.murphy@arm.com> X-Mailer: git-send-email 2.36.1.dirty MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" We currently have 3 different ways that __iommu_probe_device() may be called, but no real guarantee that multiple callers can't tread on each other, especially once asynchronous driver probe gets involved. It would likely have taken a fair bit of luck to hit this previously, but commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") ups the odds since now it's not just omap-iommu that may trigger multiple bus_iommu_probe() calls in parallel if probing asynchronously. Add a lock to ensure we can't try to double-probe a device, and also close some possible race windows to make sure we're truly robust against trying to double-initialise a group via two different member devices. Reported-by: Brian Norris Signed-off-by: Robin Murphy Tested-by: Brian Norris --- drivers/iommu/iommu.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 65a3b3d886dc..959d895fc1df 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -283,13 +283,23 @@ static int __iommu_probe_device(struct device *dev, s= truct list_head *group_list const struct iommu_ops *ops =3D dev->bus->iommu_ops; struct iommu_device *iommu_dev; struct iommu_group *group; + static DEFINE_MUTEX(iommu_probe_device_lock); int ret; =20 if (!ops) return -ENODEV; - - if (!dev_iommu_get(dev)) - return -ENOMEM; + /* + * Serialise to avoid races between IOMMU drivers registering in + * parallel and/or the "replay" calls from ACPI/OF code via client + * driver probe. Once the latter have been cleaned up we should + * probably be able to use device_lock() here to minimise the scope, + * but for now enforcing a simple global ordering is fine. + */ + mutex_lock(&iommu_probe_device_lock); + if (!dev_iommu_get(dev)) { + ret =3D -ENOMEM; + goto err_unlock; + } =20 if (!try_module_get(ops->owner)) { ret =3D -EINVAL; @@ -309,11 +319,14 @@ static int __iommu_probe_device(struct device *dev, s= truct list_head *group_list ret =3D PTR_ERR(group); goto out_release; } - iommu_group_put(group); =20 + mutex_lock(&group->mutex); if (group_list && !group->default_domain && list_empty(&group->entry)) list_add_tail(&group->entry, group_list); + mutex_unlock(&group->mutex); + iommu_group_put(group); =20 + mutex_unlock(&iommu_probe_device_lock); iommu_device_link(iommu_dev, dev); =20 return 0; @@ -328,6 +341,9 @@ static int __iommu_probe_device(struct device *dev, str= uct list_head *group_list err_free: dev_iommu_free(dev); =20 +err_unlock: + mutex_unlock(&iommu_probe_device_lock); + return ret; } =20 @@ -1799,11 +1815,11 @@ int bus_iommu_probe(struct bus_type *bus) return ret; =20 list_for_each_entry_safe(group, next, &group_list, entry) { + mutex_lock(&group->mutex); + /* Remove item from the list */ list_del_init(&group->entry); =20 - mutex_lock(&group->mutex); - /* Try to allocate default domain */ probe_alloc_default_domain(bus, group); =20 --=20 2.36.1.dirty