raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

iommu/amd: Fix race in increase_address_space()

Browse Source 
[ Upstream commit 754265bcab ]

After the conversion to lock-less dma-api call the
increase_address_space() function can be called without any
locking. Multiple CPUs could potentially race for increasing
the address space, leading to invalid domain->mode settings
and invalid page-tables. This has been happening in the wild
under high IO load and memory pressure.

Fix the race by locking this operation. The function is
called infrequently so that this does not introduce
a performance regression in the dma-api path again.

Reported-by: Qian Cai <cai@lca.pw>
Fixes: 256e4621c2 ('iommu/amd: Make use of the generic IOVA allocator')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Joerg Roedel
2019-09-06 10:39:54 +02:00
committed by Greg Kroah-Hartman
parent ed52f6cf0e
commit 785ca708a9
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/iommu/amd_iommu.c
View File

@@ -1425,18 +1425,21 @@ static void free_pagetable(struct protection_domain *domain)
* another level increases the size of the address space by 9 bits to a size up
* to 64 bits.
*/
static bool increase_address_space(struct protection_domain *domain,
static void increase_address_space(struct protection_domain *domain,
gfp_t gfp)
{
unsigned long flags;
u64 *pte;
if (domain->mode == PAGE_MODE_6_LEVEL)
spin_lock_irqsave(&domain->lock, flags);
if (WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL))
/* address space already 64 bit large */
return false;
goto out;
pte = (void *)get_zeroed_page(gfp);
if (!pte)
return false;
goto out;
*pte = PM_LEVEL_PDE(domain->mode,
iommu_virt_to_phys(domain->pt_root));
@@ -1444,7 +1447,10 @@ static bool increase_address_space(struct protection_domain *domain,
domain->mode += 1;
domain->updated = true;
return true;
out:
spin_unlock_irqrestore(&domain->lock, flags);
return;
}
static u64 *alloc_pte(struct protection_domain *domain,