Re: [PATCH v3] iommu/s390: Add support for iommu_device handling

[Sebastian Ott]

Hello Joerg,

On Fri, 11 Aug 2017, Joerg Roedel wrote:
> Hey Sebastian,
> 
> On Thu, Aug 10, 2017 at 09:07:06PM +0200, Sebastian Ott wrote:
> > With this patch pci hot-unplug fails with a use after free or refcounting
> > issue - I'm currently trying to understand what's going on...
> 
> Let me know if I can help with debugging the issue, do you have a
> backtrace for me to look at?

I would have send backtraces but everyone looked different: random mem
corruptions, panic during unrelated allocations and stuff like that.

..but I found the bug, actually 2 bugs:

* That patch embedded a struct iommu_device within struct zpci_dev but
the iommu_device has a release function (via its class) - so when
the release function gets called it frees memory that was never allocated.
The fix is to not embedd struct iommu_device in zpci_dev (see below)

* iommu_release_device must not release the struct device but the
structure it is embedded in: struct iommu_device (I'll send a patch
for that)

With these fixed it works fine.

Sebastian

---
 arch/s390/include/asm/pci.h |  2 +-
 drivers/iommu/s390-iommu.c  | 20 ++++++++++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index 386df9a..de3129e 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -123,7 +123,7 @@ struct zpci_dev {
 	unsigned long	iommu_pages;
 	unsigned int	next_bit;
 
-	struct iommu_device iommu_dev;  /* IOMMU core handle */
+	struct iommu_device *iommu_dev;  /* IOMMU core handle */
 
 	char res_name[16];
 	struct zpci_bar_struct bars[PCI_BAR_COUNT];
diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c
index 85f3bc5..58a7414 100644
--- a/drivers/iommu/s390-iommu.c
+++ b/drivers/iommu/s390-iommu.c
@@ -174,7 +174,7 @@ static int s390_iommu_add_device(struct device *dev)
 		return PTR_ERR(group);
 
 	iommu_group_put(group);
-	iommu_device_link(&zdev->iommu_dev, dev);
+	iommu_device_link(zdev->iommu_dev, dev);
 
 	return 0;
 }
@@ -201,7 +201,7 @@ static void s390_iommu_remove_device(struct device *dev)
 			s390_iommu_detach_device(domain, dev);
 	}
 
-	iommu_device_unlink(&zdev->iommu_dev, dev);
+	iommu_device_unlink(zdev->iommu_dev, dev);
 	iommu_group_remove_device(dev);
 }
 
@@ -336,21 +336,25 @@ int zpci_init_iommu(struct zpci_dev *zdev)
 {
 	int rc = 0;
 
-	rc = iommu_device_sysfs_add(&zdev->iommu_dev, NULL, NULL,
+	zdev->iommu_dev = kzalloc(sizeof(*zdev->iommu_dev), GFP_KERNEL);
+	if (!zdev->iommu_dev)
+		return -ENOMEM;
+
+	rc = iommu_device_sysfs_add(zdev->iommu_dev, NULL, NULL,
 				    "s390-iommu.%08x", zdev->fid);
 	if (rc)
 		goto out_err;
 
-	iommu_device_set_ops(&zdev->iommu_dev, &s390_iommu_ops);
+	iommu_device_set_ops(zdev->iommu_dev, &s390_iommu_ops);
 
-	rc = iommu_device_register(&zdev->iommu_dev);
+	rc = iommu_device_register(zdev->iommu_dev);
 	if (rc)
 		goto out_sysfs;
 
 	return 0;
 
 out_sysfs:
-	iommu_device_sysfs_remove(&zdev->iommu_dev);
+	iommu_device_sysfs_remove(zdev->iommu_dev);
 
 out_err:
 	return rc;
@@ -358,8 +362,8 @@ int zpci_init_iommu(struct zpci_dev *zdev)
 
 void zpci_destroy_iommu(struct zpci_dev *zdev)
 {
-	iommu_device_unregister(&zdev->iommu_dev);
-	iommu_device_sysfs_remove(&zdev->iommu_dev);
+	iommu_device_unregister(zdev->iommu_dev);
+	iommu_device_sysfs_remove(zdev->iommu_dev);
 }
 
 static struct iommu_ops s390_iommu_ops = {
-- 
2.5.5