From patchwork Fri Mar 31 15:32:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 13196103 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4372C761A6 for ; Fri, 31 Mar 2023 15:32:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233040AbjCaPci (ORCPT ); Fri, 31 Mar 2023 11:32:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54418 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233238AbjCaPce (ORCPT ); Fri, 31 Mar 2023 11:32:34 -0400 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2062.outbound.protection.outlook.com [40.107.237.62]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E8C9020DAD for ; Fri, 31 Mar 2023 08:32:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Tsg3tFmBIVE4+Wt3o2CrkKFEVvoA2zo0CCAx1IwDpR2rM2aUhMQvkegHPO9luX/QEYqqd2mnj6E6g398+FV1g1eEnSPn1kCbIIq6eKWJ1zL/m6Bx+hVb/e8MaRSFPVIdh4QYbEe9GvFnb0Q0+viA1WSeYYqZpjjYdcbi0OzreWfgx0JjjwD1wRSMhMlH/Q0Vvwjwkf2/OuPTetxcrYcoBjZ0wtTZ/+xUyOcWl947YjLGccC3xvy1PryoDyNwUstpt+cngNRI60pp1/xNO7W4Yiz0yeL/phr9CdVpvvz6ajFxjDK4KHI9BVQs2xBErvsNLAO612yZdOa+vl1EPLSB/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ki7X9rPZekzHolKZFmF+4Td7gVUK7vGfOxJ2gvZqeNM=; b=Nmn/CaceIN5EOjD+rpqnOPKlRgP9KftCNe7frNx5J70mmC51sWMVPQhAeeS75MIIKMLf5yCNnkYQFRGhKcs9DAOzW0AAH9TaTgyh09qJCh3NShaup8+LGCNs746SRlXSOSAzjbGkn46Epu8HiSTqwMt4eLdOG2d9RTn0GE5H3oUSW4jMFY+o5JID6LYMy/EBNyjK1jmgyUYfWeeZLk5iywuNXugEmSsx+VSuSvkWjIcS8IJ/aGoJooRkljiyTOx2zXChygnu90yGYOUwHUsC8BhiAwZ7Idm+rBUJgMavROBeJp2z/k/YvMzGNAC+xfC7zyfvZpylYMvyKf0C/C+N+w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ki7X9rPZekzHolKZFmF+4Td7gVUK7vGfOxJ2gvZqeNM=; b=ZNnx5GZDZHo0WGGSx8jQoLLC9mxHuZ60ZyX5AoCGM9s/7GzSDcudo7KbkeLwJPZliMl0C73QVBV2Ssgu3j6JC07oWmx0BR2+9Mm+/87aNP31JGCFWPw9I4ntYztbX+T4d/k+vbrOyqtIe96IWn7igFIqlSsZQaR6Mw8oTUV93utKF7x9HDYx2vhdQ+1t+x8ijy6XNemulP4kERfYFbdBPubGuYPAeZm+3zyQeNar9m46A+iiaVduHErRvLmD2Z4Rz8ejx1/4jr37MwMKHUhmQ53oCSE6VsYzj4Hb/U8BbaksOqQcA3EmGYsTM64/K4Lg4t3BdbeYc63bV7hCKVsebQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) by BL1PR12MB5093.namprd12.prod.outlook.com (2603:10b6:208:309::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.24; Fri, 31 Mar 2023 15:32:28 +0000 Received: from LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1]) by LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1%3]) with mapi id 15.20.6178.037; Fri, 31 Mar 2023 15:32:28 +0000 From: Jason Gunthorpe To: iommu@lists.linux.dev, Kevin Tian , linux-kselftest@vger.kernel.org Cc: Lixiao Yang , Matthew Rosato , Nicolin Chen , Pengfei Xu , Yi Liu Subject: [PATCH 1/4] iommufd: Check for uptr overflow Date: Fri, 31 Mar 2023 12:32:24 -0300 Message-Id: <1-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> In-Reply-To: <0-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> References: X-ClientProxiedBy: BL1PR13CA0166.namprd13.prod.outlook.com (2603:10b6:208:2bd::21) To LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LV2PR12MB5869:EE_|BL1PR12MB5093:EE_ X-MS-Office365-Filtering-Correlation-Id: 5f394ad9-75f3-43d6-eef8-08db31fd22d0 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: nk69qSovB2DhvqjbLI/vbmphD9InTD1kFBDb+jre5/calEHtXbeHE2wxvCi3+RurHtiZcLbOAcL3jQe8ptVUXTuSuCwEyWNnMGESwgSQ9eB8P1cz+5c1WPItk5B3I37c+0AyZIY5zqYoQTqB8jorecrFfNZGu49+K2sB3+KbNmextoDrPcjVS/zcmC4h0QF92b18QmbKtjmZSVRrUNi4LC8rU9BKDaBCIIP3W2/cAjXj3V0GwtbEkBovwqOq+4di4FPe6WHEOZFvwJ/4Ga1QwTQL5SgkuS2c28s8QvHiXvhZLweUFvEm20mQh392JkfK2Gn9iCJWRdAho0mOaR26x7NpySoNKn7PPSviFA33WfWqT/YzX5zegkaYdWuEoh1dUN0zviJC3bGmRp+ZvPrxuKKs23fiGqiXhHHyyfCdTAW1vDG08jw9vymCPFwTigrrOVDm2j3Mx9TxROSCjFTziH2ai0d0wOCU/zuxEvS4uHaLomUKA7e5bq7cGhk9F9KL3J8o/BCx2UtGMM2KsjmuTt1QCoehTehg5U0k8Y7l5gzkTK1AxZkKxYrd76WbhkCr6cC+IEuqpoXgTPEh9rqtZr0ZcxUtYZxDIOaR8WJmPFDs3kVkgjtMoKMXcKjSfgWHdKDYfLpWg9t/xOG7hOj3qQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV2PR12MB5869.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(4636009)(136003)(376002)(39860400002)(366004)(396003)(346002)(451199021)(8676002)(54906003)(316002)(6486002)(966005)(66556008)(66946007)(66476007)(4326008)(36756003)(6512007)(6506007)(6666004)(26005)(38100700002)(2616005)(186003)(83380400001)(5660300002)(41300700001)(8936002)(478600001)(45080400002)(86362001)(2906002)(4216001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: RprWfBUt93EldFUbaa0QVeCsGk5sIX2E5kaTUtpmvfJhepPaiXzMytbEAkWApClOFQ0ieDxusUHaormH2guhVaB1y/J5BULPG44rIKs4nJFhGMX1mWFanGH8jkkhPiT6HUVS9QQiDTH26xjgimtyPo5PqtTynXg5IEEwFFx+qAHY78MM6IIflNtuQhrf0jHBQh4PCA5DWz4x+54tR1dIfffgBBtkQ+8pE3B/HXMkpaep91gvKKI6vEoMrSpzFoinlsDg4Bl/KlwQJ2lTDpmeIIGzdZ9wsBB/3DkSLTrSCADa4ixLWvC5aV5NyWC+SdvVO/t3YBblZ50Hnu0GMf037cJRtuSEOduBMSvH7Vrl3hVATDnIg8L/0zvIDlEYXaZUu/4L4kcP8wsk+9B7cvddn9mxmiDs7UVoyR8mv02eeabJDkEbxcJbDkmZ9rlsgIgZSL7FjOx4V3nvVtcvCYsYgGUpOozzMKPYOQf6cn9OTuJx8/Zzfec96JlwNZWUTvXOz+X0KS03PmgJDRKTGaXJnAw9lpkZlilk1yp7dHXG0t2QxGU/2o8xaEqYxP+femRWAl7tgg9Lu9glCRpfM0Q4r9bPwgxFJJzT4Nl7e52WQuKxoAB/YVyGDpuAfRKmP4WVwhMlcvPWsxjMIvEA9sUajwvxQr8s7l6fEcE6bTk7qtD2El4Zf+emvMmJkvqbgBSp79V99c2phgPG+SsUYbXlhYEwPIfTxSm3E3vkwp/dBrDbauQkDCapZg6sAC52RnGw0vqpxb0CfgUCIDMov0o9eLUPkSva48Vl1uBac9KuID5Mg3X+Xuqg2u6QQBOElW2argd8ev1GDOUC4760/9Trstq6sAMa2RlhIoft6h06CeaGLFpeTrfNg8Et6s5l1bunW8Yzf6tHXB24PCRS9Cg5X3KalI4xTQ5y/rhZUrNmtfiJPFmj63DhqDX4olJOKEx1yywnSBVF8purJSPh5RjZCO01KqGHJ6+kpu47wJh5d4tRHI5OVgV+D4tfdH4GURARy7FoEDbBAULUyhsnD60eLriUihiqSAoNodSpi2zSejFhlRZ+Z0fAibzYSRgXLcSRmgey2Qo4dyuZSZAuC1RkJZU9ElAR36mPo397WLPVIPayi7XhvbXRdFA4fb47Pc7ZMxoSlCuFUV4bcdI/sRG7J9eUM6Zb02TyMybF0wjP4j2n/PNTbcia4RiwZhFybEfu9pEE7z7kgc3Tzqu/OhqC+XyjnQuZDTzeKx0smNba0WCSppt67YRTf4jkuclQ/VOilFzC0+JrWScxEpZqoY3ICIfrHQcnaP7TJq9RtsPeHKj4J8Bg9HwHBktq8VcebnLabRaeRYRL7H/4aygaioHHDCp8lO3tYeV9n211C3lFUbNYVgGuWZaF1hjzPRHRxRLvrz68sbhFHAbRnpuMefR/lyvGSx7cfakM+l/JXT+i19u+lf2i1cvlN+cvcdTQnTde/Hwt0PmV5i0J7fbSbAVmZpWSTWqLQxRHzpBjQu5KurDGUV1yMP0frSHQp8S2+yXnL3ZWDTr05J/nYBoBmHe9OyGqbGTiehQlTesQam1xHqW25HpBtMW8mHYIQWiYeE+J X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5f394ad9-75f3-43d6-eef8-08db31fd22d0 X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Mar 2023 15:32:28.6005 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Rh7JXX3pB2+7p91TcbP5h5xVMKABGoAYdTSxnQwyOXUAZyxKD25zD1vNzRwv2if2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5093 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org syzkaller found that setting up a map with a user VA that wraps past zero can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0 due to invalid arguments. Prevent creating a pages with a uptr and size that would math overflow. WARNING: CPU: 0 PID: 518 at drivers/iommu/iommufd/pages.c:793 pfn_reader_user_pin+0x2e6/0x390 Modules linked in: CPU: 0 PID: 518 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:pfn_reader_user_pin+0x2e6/0x390 Code: b1 11 e9 25 fe ff ff e8 28 e4 0f ff 31 ff 48 89 de e8 2e e6 0f ff 48 85 db 74 0a e8 14 e4 0f ff e9 4d ff ff ff e8 0a e4 0f ff <0f> 0b bb f2 ff ff ff e9 3c ff ff ff e8 f9 e3 0f ff ba 01 00 00 00 RSP: 0018:ffffc90000f9fa30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff821e2b72 RDX: 0000000000000000 RSI: ffff888014184680 RDI: 0000000000000002 RBP: ffffc90000f9fa78 R08: 00000000000000ff R09: 0000000079de6f4e R10: ffffc90000f9f790 R11: ffff888014185418 R12: ffffc90000f9fc60 R13: 0000000000000002 R14: ffff888007879800 R15: 0000000000000000 FS: 00007f4227555740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000043 CR3: 000000000e748005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: pfn_reader_next+0x14a/0x7b0 ? interval_tree_double_span_iter_update+0x11a/0x140 pfn_reader_first+0x140/0x1b0 iopt_pages_rw_slow+0x71/0x280 ? __this_cpu_preempt_check+0x20/0x30 iopt_pages_rw_access+0x2b2/0x5b0 iommufd_access_rw+0x19f/0x2f0 iommufd_test+0xd11/0x16f0 ? write_comp_data+0x2f/0x90 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 ? __pfx_iommufd_fops_ioctl+0x10/0x10 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Cc: Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") Reported-by: Pengfei Xu Link: https://lore.kernel.org/r/ZA/O6vGUfni158oK@xpf.sh.intel.com Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian --- drivers/iommu/iommufd/pages.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index f8d92c9bb65b60..400ec7c91ed7e7 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1142,6 +1142,7 @@ struct iopt_pages *iopt_alloc_pages(void __user *uptr, unsigned long length, bool writable) { struct iopt_pages *pages; + unsigned long end; /* * The iommu API uses size_t as the length, and protect the DIV_ROUND_UP @@ -1150,6 +1151,9 @@ struct iopt_pages *iopt_alloc_pages(void __user *uptr, unsigned long length, if (length > SIZE_MAX - PAGE_SIZE || length == 0) return ERR_PTR(-EINVAL); + if (check_add_overflow((unsigned long)uptr, length, &end)) + return ERR_PTR(-EOVERFLOW); + pages = kzalloc(sizeof(*pages), GFP_KERNEL_ACCOUNT); if (!pages) return ERR_PTR(-ENOMEM); From patchwork Fri Mar 31 15:32:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 13196105 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A05EC761A6 for ; Fri, 31 Mar 2023 15:32:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233002AbjCaPc4 (ORCPT ); Fri, 31 Mar 2023 11:32:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232439AbjCaPcx (ORCPT ); Fri, 31 Mar 2023 11:32:53 -0400 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2062.outbound.protection.outlook.com [40.107.237.62]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DBDF1DF86 for ; Fri, 31 Mar 2023 08:32:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=S8MfQEFbiBfgOd+SQrWz19tyiUVjIuONBk9miPy8E+wVrNmbs1cMoZlQjEKX4IwYl48WX2E36VN8LPqKD3S9D6W+qse+IYjpFTJzwa2uYs9oESf5dLPFkACEFsHVDfUphUQ7YbrNylBkUBk79mOmDptIxVyk8D57rbjISGXPdDgsajVoNFTEzWmsRbUSQz8PQlLOH7l5AhPyx7VW+H3+fCE+PvTPmq0ZTnxT/xzz12e63GnLuEFLtr2BT4cK5UbZkbwugTXjQbiIvrVpiHrOm5s9us4LoSY55AcOnRCEAOFseAbYcASOfeg8ItfMhYuHLlih9XazFTJypYAammXidQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NKfjiTCoG73oiv986QSHGtlQoVKfS7VuLo3ijhVE5Ts=; b=ZDxnK/aC16ZSMSf/0Iv5uMbiCwt+ffeR+sQp6Ji3J4yrIS7qzWrEHr/ArtHHo/5znJsilBLUitA/5owfdTdX/DCEhOCb1R9HZ/Faj4Xwnx4/0kpfyuVnkAk1B+HGM7yywWQ+imRd6RxNL7XmyX79YhPZkLQo6ksIgw728n/fMxqdRdosQQmNp71L4/9HaPtcTn9LR46ZC6EffNSUuNp5qSdQ17QZ4X4vyOdTlsLAadp6a9YSQK2OMkat8x64fMbfJFKM0foALYB7WYnwFAkYtNFogMXcr1PuL4/zjfTE2yybs6lX/KhtM6sJz+XsYd7uYnmh82ovkYAxoEP60rSyDg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NKfjiTCoG73oiv986QSHGtlQoVKfS7VuLo3ijhVE5Ts=; b=eUDDUldgrQlBwstJNoy8kUe0iHV92x2YyMpLzmFBl+RxMgKU2p42H9rbiM2xPdnHkdjmKv45lOAhCz+3uQQkDqbptkTpWGIaj7JNJ5w3Zw1n7yLnG6MRhr4oQRxKa/Pyts0NKn1pahlbdOvfEupenKomjEwAW3TprdO9S69cgnHvigHNO167LDaCR7kBAkf4F48xUc93fQUUkc+rA/9slVaApn2qDQzLidjetNtItZJd+WqqITbmdzVzC1rElTPuPAYLwKnm0aHkuU8wsxYfjnH2wgB9B51i6vJ0sKp4ye+pdD0Hqtqk6NhqRpL9BSoe7Ydd8ItdUMeK/V1cg0JdWQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) by BL1PR12MB5093.namprd12.prod.outlook.com (2603:10b6:208:309::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.24; Fri, 31 Mar 2023 15:32:29 +0000 Received: from LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1]) by LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1%3]) with mapi id 15.20.6178.037; Fri, 31 Mar 2023 15:32:29 +0000 From: Jason Gunthorpe To: iommu@lists.linux.dev, Kevin Tian , linux-kselftest@vger.kernel.org Cc: Lixiao Yang , Matthew Rosato , Nicolin Chen , Pengfei Xu , Yi Liu Subject: [PATCH 2/4] iommufd: Fix unpinning of pages when an access is present Date: Fri, 31 Mar 2023 12:32:25 -0300 Message-Id: <2-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> In-Reply-To: <0-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> References: X-ClientProxiedBy: BL1PR13CA0171.namprd13.prod.outlook.com (2603:10b6:208:2bd::26) To LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LV2PR12MB5869:EE_|BL1PR12MB5093:EE_ X-MS-Office365-Filtering-Correlation-Id: 479064be-ed74-4486-4e4d-08db31fd22f2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 39EMAmHcvA8Swmfl2QXx5IRE4e7ie11Qm5uZLTec/CMCVf5fLXjXfvVNGYz3BQHGUjJ2nO4Na8rER6H2QveqwTOIQfcMKBBVGasvHxG1ruPbwan+hMSVi2/ZtJ2v3+CdIUO0DpTOsJ/HeqCyXCjGNEZy+zKo7/IHWTtJVK3PWLqgDVmy5NQhhhJpZzRnBBTckmu/fU6oD+44y5GG1EgJt5mkdzpA2vpKi5j/ynR84YN+p2tyegmhaoXd6YcT+nOjT5M1Iyx0ou+kX2TFvBT6r6AEonG/7sEoaq7NxWtLqzKE+cD4GFgmAnU5W0F0R/O59zpQ8nqa6f1MB7ZLVM2AzgMdIenUkG+AsvY7MJ1MBljZssUKfZcZUFvoObtWGa1CUgSBA+xou1bRbAHeHcOQjGJiPFuiE7tg1xH7QrhNLGH7NvMPTm2hfVqB3mKXfYCW3ZMqQZqmWIq6/2iBJieJoCvLclWGKg/5OpQFtP3lLmeJlx2VsY9SGNR7wA8wQE2dMKBkz9Rv+j/j8HQTf4DJ1/TNla7k5ye6fAyPB0PcBaXSbqAw8GC24Ca4lzi9gU0PRibDSrf6c9dT8Ts7Fzgu/GmLDe3AS0tHXVmWvAFqbU+ZMBhQce0OPwJw2f34xJmZ7pRRm/uFuJpJWOR9AfZmnQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV2PR12MB5869.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(4636009)(136003)(376002)(39860400002)(366004)(396003)(346002)(451199021)(8676002)(54906003)(316002)(6486002)(966005)(66556008)(66946007)(66476007)(4326008)(36756003)(6512007)(6506007)(6666004)(26005)(38100700002)(2616005)(186003)(83380400001)(5660300002)(41300700001)(8936002)(478600001)(45080400002)(86362001)(2906002)(4216001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: xxEEV4FtylAxPY4qLBNxP4swHeJkxNh4JtGwc60QkNR/DbI1bPzmv7irEPDqSLO0mv0ihPj3XEocBoVckkSTZbvhkG0XolDRlpHIwWYJm0+2bNrbR8LqPMm7PKvvNrUcfxAmWD0yniZSYutoY6X2nV5r0ai846pMpVBMLBJor5KKSHY65mEmUpEpFIRjYt0uxk4uhK5HYT8wW1heU5sjB+AuVxP7B76UIBP3HTl3K1dPhgezi3fDjnzo8SeYaPabEvTr+3zcpcjy2TAnpBkF8iLTLEoLkd6GZzZBTPZp7rhWDV3ZG0GkI1JHiaK0QtzYuDYdlFuFk2S08EUdV1GoYBMWM7SevnqEX7LSH09lVMi3TLotdcLzorpb+64YVvhOVx0dfx2Z1AzczG7+190VCIQ21mn0OBZc3TSjOfc7zi/1Hu/cNI5kz8LB23JzkXlInohCELXjblzHsmHrBkBybWMa67vmKqUTtbsWzp8lS1NdTBKiJpE4hmpnx2L2nv3pMxUlgWPASZfuazr45k/xRW7R0cWM4CpC7gNolCGq5DvA82WsF2QOfD1BU8Q4IFfKVLbE/RVjTtUpZbRxjsJ8Cxc5HUFJYgIMcesXnmlMUI5fkwE4vrRQmdHMMM9otV5S4RDjk2p2oVZBw0JqyMKkw4l1scKBw6ugvSrgKURRW211GoT4vu/4UFYhYF/LxWjdEQo3G8QBivPzSdeQ0e4HVVsXaZgEM07vcNqbkfiAXPqkGF8zG9gW/nOpsuU1HeQPhWKB9+8AsRtDSVdcpeA62x69lJLMSg6h962sxtAHKOGhArx7aT7tznAv9k+E6ZnVi1+UlriLefCZ4qtb4yUqiYr1HR+D/K3nAsgDeZ/ANVTyRS5kCNcNdoAacMoGmmr0mi1Qf/k0uZUSvw/ntdfgAjvYDggLAXE0wWoJxwXCv6spJOP/kYzpis3phew45bwaBeA/3YM32o+2rkfTLAIB7jmlNJtdLerdBAwPzo3p7TxE483W/ieGPLLCOyz26qUznSjddf7DU/50gmtyGo56ogSJFbHIQR/1yaMPrKG6eIxLdVnVjrlPKhMyeQrw9T2KJ0dX/9jBtB3D3tUHgOGHlOp4OAy5rwg7cn2bajOpLwh2DHjmuIvszlB/f0ICmMS2euDEYlmieP/wAYlSshm6ughFJAILleCCD6GnxyGn1/Tgh0jfwznB+404a7CXVAn8hz57WAokc9v+MbGUhdhsSw4cvIgZsH9Haag2UOTlW8ATya7GefCoNNI9/Iv5++yu+2Ux89xzCWajvrxni4NvbK6iOEVu5xwnuvj8gJ+BzdNmlAB1GK+Z5sHGimGIg8EhcHnH6ORdnyg21LKAm44JWQyKM12G9CYdbUkQco8XHeJFhKHaXAs+6OPoVFfYCsgR5cbh1sE0kyA3oNhfWnUKfCwqqRF+3ucN5BIBCpq96X3jQWSNuFKvn9SZ9Cjvt/L32Uxf/JtfpPENnLCf8XuaTfGJo4uSe93cINFbmeIBuIalXGK56zFilTUYkHXenklsqMYYeYmDp8RVnfiTmy24Z6SkabxNchRbDTOsKaWyH2uWz5E+Y15me8HPCmqSkFwH X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 479064be-ed74-4486-4e4d-08db31fd22f2 X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Mar 2023 15:32:28.8036 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8P9MLWVac4xbUAlgJIruM2puuch/Ms2euy0VpyJxO8pSDVhF4yREGzuUJpK0E0AK X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5093 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org syzkaller found that the calculation of batch_last_index should use 'start_index' since at input to this function the batch is either empty or it has already been adjusted to cross any accesses so it will start at the point we are unmapping from. Getting this wrong causes the unmap to run over the end of the pages which corrupts pages that were never mapped. In most cases this triggers the num pinned debugging: WARNING: CPU: 0 PID: 557 at drivers/iommu/iommufd/pages.c:294 __iopt_area_unfill_domain+0x152/0x560 Modules linked in: CPU: 0 PID: 557 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__iopt_area_unfill_domain+0x152/0x560 Code: d2 0f ff 44 8b 64 24 54 48 8b 44 24 48 31 ff 44 89 e6 48 89 44 24 38 e8 fc d3 0f ff 45 85 e4 0f 85 eb 01 00 00 e8 0e d2 0f ff <0f> 0b e8 07 d2 0f ff 48 8b 44 24 38 89 5c 24 58 89 18 8b 44 24 54 RSP: 0018:ffffc9000108baf0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000ffffffff RCX: ffffffff821e3f85 RDX: 0000000000000000 RSI: ffff88800faf0000 RDI: 0000000000000002 RBP: ffffc9000108bd18 R08: 000000000003ca25 R09: 0000000000000014 R10: 000000000003ca00 R11: 0000000000000024 R12: 0000000000000004 R13: 0000000000000801 R14: 00000000000007ff R15: 0000000000000800 FS: 00007f3499ce1740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000243 CR3: 00000000179c2001 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: iopt_area_unfill_domain+0x32/0x40 iopt_table_remove_domain+0x23f/0x4c0 iommufd_device_selftest_detach+0x3a/0x90 iommufd_selftest_destroy+0x55/0x70 iommufd_object_destroy_user+0xce/0x130 iommufd_destroy+0xa2/0xc0 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Also add some useful WARN_ON sanity checks. Cc: Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") Reported-by: Pengfei Xu Link: https://lore.kernel.org/r/ZBE1k040xAhIuTmq@xpf.sh.intel.com Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian --- drivers/iommu/iommufd/pages.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 400ec7c91ed7e7..b11aace836542d 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1207,13 +1207,21 @@ iopt_area_unpin_domain(struct pfn_batch *batch, struct iopt_area *area, unsigned long start = max(start_index, *unmapped_end_index); + if (IS_ENABLED(CONFIG_IOMMUFD_TEST) && + batch->total_pfns) + WARN_ON(*unmapped_end_index - + batch->total_pfns != + start_index); batch_from_domain(batch, domain, area, start, last_index); - batch_last_index = start + batch->total_pfns - 1; + batch_last_index = start_index + batch->total_pfns - 1; } else { batch_last_index = last_index; } + if (IS_ENABLED(CONFIG_IOMMUFD_TEST)) + WARN_ON(batch_last_index > real_last_index); + /* * unmaps must always 'cut' at a place where the pfns are not * contiguous to pair with the maps that always install From patchwork Fri Mar 31 15:32:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 13196104 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97366C761A6 for ; Fri, 31 Mar 2023 15:32:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233218AbjCaPcn (ORCPT ); Fri, 31 Mar 2023 11:32:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54384 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233237AbjCaPcj (ORCPT ); Fri, 31 Mar 2023 11:32:39 -0400 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2062.outbound.protection.outlook.com [40.107.237.62]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 881DA1EA2D for ; Fri, 31 Mar 2023 08:32:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jPGEeO8nNIPt7wlW0JYWOgeyiodJ1KlPWpgWXNxZpGcDnyblwSbiEvWsoAIttGfZ0NCvw77WBqH3BWHtND+aUCHqWmmtOMdzFKfrFpLP8wRkeYPlWV9RRKVXlrFm/1QEcF2RV4fVGJYZvRF5RpjupuO7AqR2xCcG4ACjo3Ll8cE1z1zZqHHZH49EWQ/JJ4t0bGk+3K7bPs9dZ7EKnKBOC/8e7nUpArhraWiycDqz6RBWSCvym7hSyR17f7DZXGZBKghh8MeyeGKmL+bPieL6ja2JNmeXQ+5jf6Z77BNehXZDUfGcIbRt2xdFPts9QIf645QIy7WnBSRRjwhLPM1WQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WRsjRPSHJHxMXlisbBXj0goSuYS4q1To/1W8tMzVR8Q=; b=ejy90+qHOjQL4ZLzJXEQXvkuc1a4WWmJ26u3PU8gz/ETdMrPpfGjsFxQYSL2ak1SXRihGN7j4l7VpYL+tTFBxy5NwHTrx8SyChGCpBHvPoMrrzVTwiP5pR/xesC4YlZXz/1pnizaAn7aVF2ahCAGPmGIX2es3gkbwLP6/p7E55o3hyjpeO+58E5pALIoLySzSuMwhS0hCzJ0luFccJdJiygA1BMXWZWRmXAHeLWs36seYrZppZukNwX2DAjSkOlLMhpopO174b9CLJvzdrwsFAUbeVZxFIJuH07/hBbsuOWnjyaNDLfSIQa74pCp8gRDACs30mdFRCwN+bcB+wiZBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WRsjRPSHJHxMXlisbBXj0goSuYS4q1To/1W8tMzVR8Q=; b=uALBxpeCUY3wH8dtV7EjTIggMM6n6nAY7g4FQGo7rjC6Rshk53zkRFaZrxyp/8S6OtgJR1M41TCvqJANn0rv0R5kn0S/KkNsvX0nFFZCV5MaCo40yM96yZ0KIRTDHrfqeYH9HEi35LQHwh52lfwOC3CaeTCML3FCRelmpS7Sgid1P6Rl6tS+C4QzuijJhaqJ61V9xHXQcEs3eb3XbCkAis9r4Bqk5s0M7dxuq//OnDgT09m6vNrWjyXusYqJDqQPuv8zuL4HWuD6fKdPZC85hRxRzpfucQ+GBhiYLbIgd55jP/RL2nw0UnPj3ozVPfJrJ1uctcz15nqqipXw80mCvg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) by BL1PR12MB5093.namprd12.prod.outlook.com (2603:10b6:208:309::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.24; Fri, 31 Mar 2023 15:32:29 +0000 Received: from LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1]) by LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1%3]) with mapi id 15.20.6178.037; Fri, 31 Mar 2023 15:32:29 +0000 From: Jason Gunthorpe To: iommu@lists.linux.dev, Kevin Tian , linux-kselftest@vger.kernel.org Cc: Lixiao Yang , Matthew Rosato , Nicolin Chen , Pengfei Xu , Yi Liu Subject: [PATCH 3/4] iommufd: Do not corrupt the pfn list when doing batch carry Date: Fri, 31 Mar 2023 12:32:26 -0300 Message-Id: <3-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> In-Reply-To: <0-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> References: X-ClientProxiedBy: BL1PR13CA0165.namprd13.prod.outlook.com (2603:10b6:208:2bd::20) To LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LV2PR12MB5869:EE_|BL1PR12MB5093:EE_ X-MS-Office365-Filtering-Correlation-Id: f1fc77ee-2abd-4bec-630d-08db31fd22e6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: +7cEbYE3EaggymjHWSnoM4ETcDJCn7xw+sZbpC2q0AFNLQJ7r1TW28amvxO7x/YMw6UUxiX0Q7p9xIbSKvfBIBQ6OWUbk62Vye3H5fpazZksXvSNzTWHiE0KCWHEmIcinVHs6wl0a7JRpv6kW/kTjUFXJcKTRAWinaTh8ZnUKze1Hjbc/gZ5MUau7ijWEGnAl9EElE9+Zm4ttEjeMZxJtVyQw9iw61nxSZsxQ7BGZXq+WcN3w1weoXIfeSpf02WRk1aQe6FknMS4rhdOTgowgRzr282Hm/5F0FW87Qcqu/vdMKoyYNCTGg+Q1mQguWwfVeQeRjI1QVKtuoHk0zjrA9sT/M72vGQ4D646pRfst7YwqyR1j4g6WqKQ88g3Mawgk6K/ZygLgysccoleF3oB1pOqqRY2PvccxD9Pt9ICJYgm5w8e+TQumNe8HV9jrK8OwsTiLCYm8ByB6rPPb4wU0NXBrmusQfErrVEmiDiBIaF8P0WT80nLUwyeXYbwG6tE5JqjTTPvUWHOxUjW08NiT4KjkpSevkWa4xH1Dt2X/PTApF6Q9ETr5wHU3RuPuheF03FSBQAsKPm+g8sSsq75CHhPBSzPkqSAgxFIils1959iDSTNWBc7VdrQCaaJ0HomylBUYi7Y+NMLeXib1Uv3ZQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV2PR12MB5869.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(4636009)(136003)(376002)(39860400002)(366004)(396003)(346002)(451199021)(8676002)(54906003)(316002)(6486002)(966005)(66556008)(66946007)(66476007)(4326008)(36756003)(6512007)(6506007)(6666004)(26005)(38100700002)(2616005)(186003)(83380400001)(5660300002)(41300700001)(8936002)(478600001)(45080400002)(86362001)(2906002)(4216001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: FJ3Pg86jFSB7JnH4DAcxpX2yS5O798+2db6c6XavdrX5++SAt4qIOXPL6qmye4PL2dVNZS6+Zqhb8LuPqq7/GYBY4VNvwkQiUTunBqtQzeZx2PUqdEtBgOLdWiuWdd8kFspvefp1ELfzXC123zGQJiuFjJzYgo65oxRW5FPMgZCh4WDX6PouUw9tP2wby9t691I8/XpBZ/W8nTn93d1+4HLsjrz/kCPRrf7ucpTe1dTwC91QhqOmkPgLkeKEe87zFnLeUe1JQurT8hTPloc50gFUDKLNMtdOyhPN0cora+5x81xDeCJIFAXDRL9bVbH47kr2azv6CW1oliKNUgG8IVBwZcmXwFSkJyhEGqTLeyeSnfOq9qNjIhiRcoVA4l06yYkGckM4fVV+G+EmFG94LS9aoyuVtRrTLBffk8ZLW1kznDmyF9+UEQvAkx0NkpHMQ7mDAgPS9NnG+KeDj7quJE8qzqt4YVuQafgipFrRJLQJV7m1y8kI5QuPpFW9gvJKvgZw+364pLYDZDRIdwdhizgxLL87LDa5IUvL3H4Mkc/s3tWQo8AUX5ZOFCC9Q+5aqwdqsBDYoQh8Hc3ixC0GuhkA+Q8vh3aYq5SXEF39qGoJns7cze3/KoIhJA8TdKSg4pWFInYEwLnFVhYsmQNYz/Fvn41oc1HR/2TmWbGjCUy4Xhe3oENhFPhflQV7FW9k2u0E57NabhRlSRR1LyvwtjichPvPWrd1nh/7b+S1gDcLMdwxpler31XzguFM8YxIAS0I5VhW3KjyJI1r8erezRu8IDtB2jUAnw3A5Pa1gvruydQ+eOF0Se/FUYt3bh4AMGU3PLy3XzuImWtDJSKyL/+qptOOhNT864av7sO/zhK1ru3RokoWF9TI3DGfY3VANqmmFcr91DogIasdpNks275FpWXDn6z4N/gN1lr8JXK1pduZsFuz5/lUfgQ3+jSmy4TvxO60UzSSZir6Enh5j467NnrV9vQ3lhUn0FHwU3IR/0UAzhxxv8xcBrKgpWztdjxxVORL+nRswGuE9ZLXXpNhDjSF1bWLpqZ87r1elGfoHSPXYCmnBdmU+DUW/faSRKNb0TNbV+DPG7XB7giMbvgWXMe2WF87ipLvNGC+wtRTdhHNmpTMCTLk3ywv+6pjbm2l5SDdqY+W9GrTVqfZ95tWQQo6TUmkdcJry4BzNZvZydcp+GnYDPW9GsCntK7KCwuUXhVucmAvUlv4bTlbQOWe+i82ZnhXIxvuAspY1qaGDJTMk4HisgoLFpEVKW2pLbP2l5915t0OLjuqTk8GwZqsS0vCUgqno7ysQxKSWI0OuKqxBeOdOgvEaf/unb89iwKWyXMLYIKowGR22a5imG+zm6Jh95PLsaafv0fIg3iZOhk3EiJdVCK4+rHb5vzCS3jQQTAeON/+zCnAo7Z+JpQ09ctXTcFWECN74Yaj5R4Gfz86CfUBKchIs0VFF5m4Jy/2pP0JQMYeKQ5fO2m9+DJ5uN+A7RVEPf9nWBOLKJwn9Y0DQtdAN3XFUGa2Yuro/EhWYa4FZSr2APRGTtgdidKLOHOIdCZNlqBhVcDGLxeYZE3ghyHCjOFxdkxF0ti1 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: f1fc77ee-2abd-4bec-630d-08db31fd22e6 X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Mar 2023 15:32:28.7255 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6/dIB6U7b6SU6Jv/iJIx/Be5h0RnKyc0P87c/aUeM9ef9N+cJnhNJGAf8hg0LCgx X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5093 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org If batch->end is 0 then setting npfns[0] before computing the new value of pfns will fail to adjust the pfn and result in various page accounting corruptions. It should be ordered after. This seems to result in various kinds of page meta-data corruption related failures: WARNING: CPU: 1 PID: 527 at mm/gup.c:75 try_grab_folio+0x503/0x740 Modules linked in: CPU: 1 PID: 527 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_folio+0x503/0x740 Code: e3 01 48 89 de e8 6d c1 dd ff 48 85 db 0f 84 7c fe ff ff e8 4f bf dd ff 49 8d 47 ff 48 89 45 d0 e9 73 fe ff ff e8 3d bf dd ff <0f> 0b 31 db e9 d0 fc ff ff e8 2f bf dd ff 48 8b 5d c8 31 ff 48 89 RSP: 0018:ffffc90000f37908 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 00000000fffffc02 RCX: ffffffff81504c26 RDX: 0000000000000000 RSI: ffff88800d030000 RDI: 0000000000000002 RBP: ffffc90000f37948 R08: 000000000003ca24 R09: 0000000000000008 R10: 000000000003ca00 R11: 0000000000000023 R12: ffffea000035d540 R13: 0000000000000001 R14: 0000000000000000 R15: ffffea000035d540 FS: 00007fecbf659740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200011c3 CR3: 000000000ef66006 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: internal_get_user_pages_fast+0xd32/0x2200 pin_user_pages_fast+0x65/0x90 pfn_reader_user_pin+0x376/0x390 pfn_reader_next+0x14a/0x7b0 pfn_reader_first+0x140/0x1b0 iopt_area_fill_domain+0x74/0x210 iopt_table_add_domain+0x30e/0x6e0 iommufd_device_selftest_attach+0x7f/0x140 iommufd_test+0x10ff/0x16f0 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Cc: Fixes: f394576eb11d ("iommufd: PFN handling for iopt_pages") Reported-by: Pengfei Xu Link: https://lore.kernel.org/r/ZBExkEW/On0ue68q@xpf.sh.intel.com Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian --- drivers/iommu/iommufd/pages.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index b11aace836542d..3c47846cc5efe8 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -294,9 +294,9 @@ static void batch_clear_carry(struct pfn_batch *batch, unsigned int keep_pfns) batch->npfns[batch->end - 1] < keep_pfns); batch->total_pfns = keep_pfns; - batch->npfns[0] = keep_pfns; batch->pfns[0] = batch->pfns[batch->end - 1] + (batch->npfns[batch->end - 1] - keep_pfns); + batch->npfns[0] = keep_pfns; batch->end = 0; } From patchwork Fri Mar 31 15:32:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 13196106 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95E2BC76196 for ; Fri, 31 Mar 2023 15:33:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232439AbjCaPdI (ORCPT ); Fri, 31 Mar 2023 11:33:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55546 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232396AbjCaPdH (ORCPT ); Fri, 31 Mar 2023 11:33:07 -0400 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2062.outbound.protection.outlook.com [40.107.237.62]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4BBF1DFB1 for ; Fri, 31 Mar 2023 08:32:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZbX3YiocthXIPmVdvCviJB6FU3Kg2JnhvDr1xXN79F9blbAymtYWCH38VSGw0pEXrNh9iKnx/4DpUkjdyr5doKJ6ubnRhNyKBqiEZ2EYiMwrUNvGv1F8QIPmpBGQZdtdh1MbzpZ07VcQnXOlOJOd3lhruZtO0IFwaNgus4OuyQSycwY0lqTWAN98yWAb/O/stKfB2S2eI8yV7OgvuiMI9YVpJLKzYCBVI0n5sfFInsTvwM6ubXqAJwjZhdmTprlUnu0IHQnjL4/EyccJnn/c4Hd9MUDx3WSJBbTUuv0veoZd4sGRkQHQdGeXDDu5O3UuSCvuZri7kzOIlkPD0YnUtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=M0591Fjy4KnKEslRRJa5GGfGNMMZezw8EwTcBf25l8Q=; b=gLWajSUi5yzKzzXXWthuoOJ3eEshSCPIgR51ng5EJPx3fWpn+cTJxDBxu4Ahy9HKUs+HmxSIzrSGO4Hpz4TZortucbJyiK3GKOrX8UagZBrFC+JpwD/w+r/vEkS0uYl52ccyA6Qd0RsVEEmwL+9DNehzQUU3qkqotefisz58MGLJVJ0j3YL3YBytVyg5WgZZkp5rYPnFzf6dH4mKgBPESpKihqObv50EBsYTHulu4WZuSVfU/ET1Q91Eooz6ryQIIunimrvwgF3bQ9R9/XXpx7R5ENsHzG2kZiBoEPkGWXJ3lZaaALaqlRknKLN6a56ADYMgU9g8Hww71rqKI80fDQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=M0591Fjy4KnKEslRRJa5GGfGNMMZezw8EwTcBf25l8Q=; b=gU9UK+GtAKQ2hZI4GqI7p1FNhuxpC67VYnpEnBs+7TyTn/oa1DVCt01WV+Y6CvShqiKeQK78mJNYvkWtXhxRwOJUzGmdMkYNGiy02trrLdJIFPAJlf+w6E3lIVMzkMsroVQx3/ISWju03ZskBVKb01eDI8W9a7nXOt9pRCZgUvSA9wkKXSdxX+D0c4c0/hd3jUpAJWQfuTxF+hF91vskqQufwNj6xZnDGTKfdKMNljEAkANwtr460AUA8bfLbvKb7ViOGhgRk6aCE5dO1Jvo6knDbWRr1X0ppyXUkJW+xd8jgiB4EoVhdFj4ijKULaniNVAVfsfmsPwi5i6pSPYyYQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) by BL1PR12MB5093.namprd12.prod.outlook.com (2603:10b6:208:309::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.24; Fri, 31 Mar 2023 15:32:29 +0000 Received: from LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1]) by LV2PR12MB5869.namprd12.prod.outlook.com ([fe80::ef6d:fdf6:352f:efd1%3]) with mapi id 15.20.6178.037; Fri, 31 Mar 2023 15:32:29 +0000 From: Jason Gunthorpe To: iommu@lists.linux.dev, Kevin Tian , linux-kselftest@vger.kernel.org Cc: Lixiao Yang , Matthew Rosato , Nicolin Chen , Pengfei Xu , Yi Liu Subject: [PATCH 4/4] iommufd/selftest: Cover domain unmap with huge pages and access Date: Fri, 31 Mar 2023 12:32:27 -0300 Message-Id: <4-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> In-Reply-To: <0-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com> References: X-ClientProxiedBy: MN2PR01CA0031.prod.exchangelabs.com (2603:10b6:208:10c::44) To LV2PR12MB5869.namprd12.prod.outlook.com (2603:10b6:408:176::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LV2PR12MB5869:EE_|BL1PR12MB5093:EE_ X-MS-Office365-Filtering-Correlation-Id: ee4adff0-003b-414e-2e5b-08db31fd237f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: T3Yy8XVL9Mbe0111tjxwdbtHFMkhD2U4u/hz7NFQ67hbBExpFtpb40ojZuqiNj4PUTU+o17LibtM0ffePtTCLUR7Pz1P5bT46LpI+Pc0AJhMGxJ1VbjNrumI6oYpOrTkD9JcA9bXpqNH7mJwBCbkv3jveyvRN2IlJL6KZ6YnNgoFsyMrgfUn+2EJNqWWzsbbPHUo7+nxlvpxmYl2Zsp1XkCVmKxqcvqQEYmTkcua7uPgEMke1cVfemseEOk77pUQ0CpRiQzvW3Y44itq1UGFGN7ZWLMtKLK8mNF4hyUr4dhMNMFqEA7BzUgyld5qBvLL2Ghg5FsLyt0f3uXoM3pnZ7OqWl89zFmAH51NGZaWOt795jflyxBtfs5/mDJWj69F5NmYX20E39iQoTRC11UKN5rUHqnvNKnHLFJL6+UpcHKkQJ3zvoQ7pJN8GC2pUh5i7L522YeS1R9QCTBgHz1X4qTUGCwdjp6x/+LTXp8KeNcNUb92IYQcgDtlsGfbq7EztDvPnbqVf50fFSE+YDJBKAo+JdUG6/Ed5Gzt0i9ZwAIWJtRpc0bCub6Ja2iygSUsc2hntRNJHDjb/x/MF8qomNoK0PPrEGdzUR6KP4sT3yXwEiNyvyDPWRNElpzroRTm X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV2PR12MB5869.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(4636009)(136003)(376002)(39860400002)(366004)(396003)(346002)(451199021)(8676002)(54906003)(316002)(6486002)(66556008)(66946007)(66476007)(4326008)(36756003)(6512007)(6506007)(26005)(38100700002)(2616005)(186003)(83380400001)(5660300002)(41300700001)(8936002)(478600001)(86362001)(2906002)(4216001)(14583001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: g2gpQtiGSc2rj0263P8iB+k5ebHt9zeQ7xC1zsxU6OTDRx/oXInHol8qfC3yk8GNtxhFt5C0L7L/JmblBI46TdeUPHFs/tTztss+0X6AwqAV9cWxqO7bJtn47LG25PkvfNHNvHU2IHiauYFl825Ve2wowTrgr0u3fvMfWWYUPoJAvcRE0j0TuMw7TbpP05F32oxUHH9arOCL7NLY7yiwVMEcbWrEXu5UU1wM10cZ4VrQDIpb/GqEz0dnJ4dt5B7GNVaTxyw9vOSGgpEMZ6a14eC/m9Okye3BZnOZLvfRSuFElUDL+h+qEVmOlpRHwhjqauqezJ8BALYQXeFqvuEN9nFZXKdDWJwXOZxphuIKCH65lyDpl5QwPOEyjCxMMRC0yWvN6d/rkCYRaWg7yxiqeCSGQPJyYKRPqzSROWDeX4uPTnfPS8gxjljYUcV5RyEVt0f3HnWV2G8tYUsloR1KYRac0OeVVKJ1cMolYpr13bh/RuWTIWDTbZvxwfXQ6pYDwOAjb+V2nBPdSroTlaUy5L/R/D+LAeu0GtGFQaX69HJUJ9CCudFBWSQLZLC81jjjVatGt2P1VgrhHHlRiMFGY5GAXs8tMbj7rHMPsb5ixyFKNCtMwFxDgKDq3rKF87YfRJ1fgAqH5vL56UaaIM0/aNeDUzeCWf+y1zw6HZru+RrZm6EDe4hEdF9OpSjgct7x0jV8t/Ig6DGy09/uprvel6N5s4EUpd70WlOM+UkBlT+BhcdFdMsx9OXPb+TBE1S7b+yGkS2+cl280TCDHO/aYEot16W//dytTLlCqi0tKzveWd/5RQ19lSxckOe5tb4ECnp+jXzFOlbKrBmg77UC3xh5OVLdg/4ZCzXM95S/Y7Xge304dXX3bSb8VjwyhGgeJu1w2yJQINL9QMZY0lIJLOlIiJBop0Ey3jfoUox7w/iO/CYSFaMOSuIURNKdSKSsc/Uq2Mwoc4nGm7ud2cx7K9aftMlKxo8XPdzoIbR/RvDSSe3Dv7t+ZLy+CShgT44Hs2x2HmofxVAb9ZyQkyE+YWoNtxnEC8HJwBf8Ue8jDTjRFSD7QnXbs1N2JMO4/3kGCG2p3ohv6A4RfVe7JKsZbeqYtlVVeZp/lIW/hn14gFcHhsy1v++WpTeyURNcJWvT6GgFZZZ+M1ZG0Nb5YrM7Zq9kCRthzcPLuGJBo5nMJzpu+ZH3ZX2+bN+XpRGQasVx/zcIkFhEeWRhCsZcafSY2FxHC4RwDrw1xjpqtnb1VqiYBamigWKmQlJB1gzBJsDzDmsUNU7PrJGIM7BHvLgJjxb8QHQ2SzAyTDs3JLvXMP9OLEpyhN2ijcdvJTUojBtC1CoR6SLKCn9Qj0zei5GS/p7dYRvSYWHW/0Q8Q1ShZhaMr7blqTG1HQ08+FqtxI778bWJQVGCe966AvXFrXPciusDT3AK9TNUYOdc6+TMT6CKH9BzOckFBjg7ITB/+Aa3gAduzwOH7uwkO8gNDK7yyH7DutFgJeCeiSi2Oq1XS8mtHa2WHcc6Hfcz5PyOSeeSHAj3aJp7eVz0dTi/7JuxExhPLurlOZRbeEICZuMYaC44sn6JjyuUGAtEAE19Fup3 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: ee4adff0-003b-414e-2e5b-08db31fd237f X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Mar 2023 15:32:29.6331 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: l13otZJUNyOTifFF/PAhXUaunqOujfNLtyfLsp9nWmYTJacN+F1idlDtRvSnbI0k X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5093 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Inspired by the syzkaller reproducer check the batch carry path with a simple test. Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian --- tools/testing/selftests/iommu/iommufd.c | 34 +++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c index c07252dbf62d72..a2ce8f3c5040f9 100644 --- a/tools/testing/selftests/iommu/iommufd.c +++ b/tools/testing/selftests/iommu/iommufd.c @@ -594,6 +594,40 @@ TEST_F(iommufd_ioas, iova_ranges) EXPECT_EQ(0, ranges[1].last); } +TEST_F(iommufd_ioas, access_domain_destory) +{ + struct iommu_test_cmd access_cmd = { + .size = sizeof(access_cmd), + .op = IOMMU_TEST_OP_ACCESS_PAGES, + .access_pages = { .iova = self->base_iova + PAGE_SIZE, + .length = PAGE_SIZE}, + }; + size_t buf_size = 2 * HUGEPAGE_SIZE; + uint8_t *buf; + + buf = mmap(0, buf_size, PROT_READ | PROT_WRITE, + MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB | MAP_POPULATE, -1, + 0); + ASSERT_NE(MAP_FAILED, buf); + test_ioctl_ioas_map_fixed(buf, buf_size, self->base_iova); + + test_cmd_create_access(self->ioas_id, &access_cmd.id, + MOCK_FLAGS_ACCESS_CREATE_NEEDS_PIN_PAGES); + access_cmd.access_pages.uptr = (uintptr_t)buf + PAGE_SIZE; + ASSERT_EQ(0, + ioctl(self->fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_ACCESS_PAGES), + &access_cmd)); + + /* Causes a complicated unpin across a huge page boundary */ + if (self->stdev_id) + test_ioctl_destroy(self->stdev_id); + + test_cmd_destroy_access_pages( + access_cmd.id, access_cmd.access_pages.out_access_pages_id); + test_cmd_destroy_access(access_cmd.id); + ASSERT_EQ(0, munmap(buf, buf_size)); +} + TEST_F(iommufd_ioas, access_pin) { struct iommu_test_cmd access_cmd = {