On Thu, Aug 15, 2024 at 03:11:17PM -0300, Jason Gunthorpe wrote:
On Wed, Aug 07, 2024 at 01:10:42PM -0700, Nicolin Chen wrote:
+int iommufd_viommu_alloc_ioctl(struct iommufd_ucmd *ucmd) +{
- struct iommu_viommu_alloc *cmd = ucmd->cmd;
- struct iommufd_hwpt_paging *hwpt_paging;
- struct iommufd_viommu *viommu;
- struct iommufd_device *idev;
- int rc;
- if (cmd->flags)
return -EOPNOTSUPP;- idev = iommufd_get_device(ucmd, cmd->dev_id);
- if (IS_ERR(idev))
return PTR_ERR(idev);- hwpt_paging = iommufd_get_hwpt_paging(ucmd, cmd->hwpt_id);
- if (IS_ERR(hwpt_paging)) {
rc = PTR_ERR(hwpt_paging);goto out_put_idev;- }
- if (!hwpt_paging->nest_parent) {
rc = -EINVAL;goto out_put_hwpt;- }
- if (cmd->type != IOMMU_VIOMMU_TYPE_DEFAULT) {
rc = -EOPNOTSUPP;goto out_put_hwpt;- }
- viommu = iommufd_object_alloc(ucmd->ictx, viommu, IOMMUFD_OBJ_VIOMMU);
- if (IS_ERR(viommu)) {
rc = PTR_ERR(viommu);goto out_put_hwpt;- }
- viommu->type = cmd->type;
- viommu->ictx = ucmd->ictx;
- viommu->hwpt = hwpt_paging;
- viommu->iommu_dev = idev->dev->iommu->iommu_dev;
Pedantically this is troublesome because we don't have any lifetime control on this pointer.
iommu unplug is fairly troubled on real HW, but the selftest does do it.
At least for this series the value isn't used so lets remove it.
I recall one of my local versions had a validation using that, but not that crucial either. Will drop it.
I don't have an easy solution in mind though later as surely we will need this when we start to create more iommu bound objects. I'm pretty sure syzkaller would eventually find such a UAF using the iommufd selftest framework.
Would adding a user count in struct iommu_device help?
Thanks Nicolin