iommu/sva: move x86 disable check before allocation

[PATCH 6.6] iommu/sva: move x86 disable check before allocation

Posted by albin_yang@163.com 1 month, 4 weeks ago

From: Wei Yang <albinwyang@tencent.com>

Backport of commit 72f98ef9a4be ("iommu: disable SVA when CONFIG_X86 is
set") placed the IS_ENABLED(CONFIG_X86) early-return in
iommu_sva_bind_device() after iommu_sva_alloc_pasid() and kzalloc(handle),
while upstream puts it at the function start.

On x86 this leaks the kzalloc'd struct iommu_sva (early return skips
kfree) and a globally allocated PASID (mm->pasid wrongly set, never
unbound). Move the check before any allocation/side effect.

Fixes: 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")

Signed-off-by: Wei Yang <albinwyang@tencent.com>
---

This is a stable-only fix for the linux-6.6.y tree.

The buggy commit 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")
is a backport of upstream commit 72f98ef9a4be ("iommu: disable SVA when
CONFIG_X86 is set") to 6.6. The upstream version places the
IS_ENABLED(CONFIG_X86) early-return at the start of iommu_sva_bind_device(),
but the 6.6 backport placed it after iommu_sva_alloc_pasid() and
kzalloc(handle), causing the leak described above. The upstream/mainline
code is correct, so this fix is not needed there and only applies to 6.6.

Please double-check against upstream commit 72f98ef9a4be before applying.
---
 drivers/iommu/iommu-sva.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
index 611733c02b7c..a340b805b82b 100644
--- a/drivers/iommu/iommu-sva.c
+++ b/drivers/iommu/iommu-sva.c
@@ -62,6 +62,9 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
 	struct iommu_sva *handle;
 	int ret;
 
+	if (IS_ENABLED(CONFIG_X86))
+		return ERR_PTR(-EOPNOTSUPP);
+
 	/* Allocate mm->pasid if necessary. */
 	ret = iommu_sva_alloc_pasid(mm, dev);
 	if (ret)
@@ -71,9 +74,6 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
 	if (!handle)
 		return ERR_PTR(-ENOMEM);
 
-	if (IS_ENABLED(CONFIG_X86))
-		return ERR_PTR(-EOPNOTSUPP);
-
 	mutex_lock(&iommu_sva_lock);
 	/* Search for an existing domain. */
 	domain = iommu_get_domain_for_dev_pasid(dev, mm->pasid,
-- 
2.43.7

Re: [PATCH 6.6] iommu/sva: move x86 disable check before allocation

Posted by Baolu Lu 1 month, 4 weeks ago

On 8/3/2026 7:40 PM, albin_yang@163.com wrote:
> From: Wei Yang <albinwyang@tencent.com>
> 
> Backport of commit 72f98ef9a4be ("iommu: disable SVA when CONFIG_X86 is
> set") placed the IS_ENABLED(CONFIG_X86) early-return in
> iommu_sva_bind_device() after iommu_sva_alloc_pasid() and kzalloc(handle),
> while upstream puts it at the function start.
> 
> On x86 this leaks the kzalloc'd struct iommu_sva (early return skips
> kfree) and a globally allocated PASID (mm->pasid wrongly set, never
> unbound). Move the check before any allocation/side effect.
> 
> Fixes: 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")
> 
> Signed-off-by: Wei Yang <albinwyang@tencent.com>
> ---
> 
> This is a stable-only fix for the linux-6.6.y tree.
> 
> The buggy commit 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")
> is a backport of upstream commit 72f98ef9a4be ("iommu: disable SVA when
> CONFIG_X86 is set") to 6.6. The upstream version places the
> IS_ENABLED(CONFIG_X86) early-return at the start of iommu_sva_bind_device(),
> but the 6.6 backport placed it after iommu_sva_alloc_pasid() and
> kzalloc(handle), causing the leak described above. The upstream/mainline
> code is correct, so this fix is not needed there and only applies to 6.6.
> 
> Please double-check against upstream commit 72f98ef9a4be before applying.
> ---
>   drivers/iommu/iommu-sva.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
> index 611733c02b7c..a340b805b82b 100644
> --- a/drivers/iommu/iommu-sva.c
> +++ b/drivers/iommu/iommu-sva.c
> @@ -62,6 +62,9 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
>   	struct iommu_sva *handle;
>   	int ret;
>   
> +	if (IS_ENABLED(CONFIG_X86))
> +		return ERR_PTR(-EOPNOTSUPP);
> +
>   	/* Allocate mm->pasid if necessary. */
>   	ret = iommu_sva_alloc_pasid(mm, dev);
>   	if (ret)
> @@ -71,9 +74,6 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
>   	if (!handle)
>   		return ERR_PTR(-ENOMEM);
>   
> -	if (IS_ENABLED(CONFIG_X86))
> -		return ERR_PTR(-EOPNOTSUPP);
> -
>   	mutex_lock(&iommu_sva_lock);
>   	/* Search for an existing domain. */
>   	domain = iommu_get_domain_for_dev_pasid(dev, mm->pasid,

Acked-by: Lu Baolu <baolu.lu@linux.intel.com>

Re: [PATCH 6.6] iommu/sva: move x86 disable check before allocation

Posted by Sasha Levin 1 month, 3 weeks ago

On Wed, Aug 05, 2026 at 10:16:06AM +0800, Baolu Lu wrote:
> Acked-by: Lu Baolu <baolu.lu@linux.intel.com>

Thanks for the ack.

Queued for 6.6, thanks.

-- 
Thanks,
Sasha

Re: [PATCH 6.6] iommu/sva: move x86 disable check before allocation

Posted by Sasha Levin 1 month, 4 weeks ago

On Mon, Aug 03, 2026 at 07:40:39PM +0800, Wei Yang wrote:
> Backport of commit 72f98ef9a4be ("iommu: disable SVA when CONFIG_X86 is
> set") placed the IS_ENABLED(CONFIG_X86) early-return in
> iommu_sva_bind_device() after iommu_sva_alloc_pasid() and kzalloc(handle),
> while upstream puts it at the function start.
>
> On x86 this leaks the kzalloc'd struct iommu_sva (early return skips
> kfree) and a globally allocated PASID (mm->pasid wrongly set, never
> unbound). Move the check before any allocation/side effect.

An ack from one of the maintainers would be appreciated on this.

-- 
Thanks,
Sasha