Re: [PATCH v2] iommu: Check dev->iommu in iommu_dev_xxx functions

[Robin Murphy]

On 2021-02-12 17:28, Shameerali Kolothum Thodi wrote:
> > -----Original Message-----
> > From: Shameerali Kolothum Thodi
> > Sent: 12 February 2021 16:45
> > To: 'Robin Murphy' <robin.murphy@xxxxxxx>; linux-kernel@xxxxxxxxxxxxxxx;
> > iommu@xxxxxxxxxxxxxxxxxxxxxxxxxx
> > Cc: joro@xxxxxxxxxx; jean-philippe@xxxxxxxxxx; will@xxxxxxxxxx; Zengtao (B)
> > <prime.zeng@xxxxxxxxxxxxx>; linuxarm@xxxxxxxxxxxxx
> > Subject: RE: [PATCH v2] iommu: Check dev->iommu in iommu_dev_xxx functions
> >
> >
> >
> > > -----Original Message-----
> > > From: Robin Murphy [mailto:robin.murphy@xxxxxxx]
> > > Sent: 12 February 2021 16:39
> > > To: Shameerali Kolothum Thodi <shameerali.kolothum.thodi@xxxxxxxxxx>;
> > > linux-kernel@xxxxxxxxxxxxxxx; iommu@xxxxxxxxxxxxxxxxxxxxxxxxxx
> > > Cc: joro@xxxxxxxxxx; jean-philippe@xxxxxxxxxx; will@xxxxxxxxxx; Zengtao (B)
> > > <prime.zeng@xxxxxxxxxxxxx>; linuxarm@xxxxxxxxxxxxx
> > > Subject: Re: [PATCH v2] iommu: Check dev->iommu in iommu_dev_xxx
> > functions
> > > On 2021-02-12 14:54, Shameerali Kolothum Thodi wrote:
> > > > Hi Robin/Joerg,
> > > >
> > > > > -----Original Message-----
> > > > > From: Shameer Kolothum
> > [mailto:shameerali.kolothum.thodi@xxxxxxxxxx]
> > > > > Sent: 01 February 2021 12:41
> > > > > To: linux-kernel@xxxxxxxxxxxxxxx; iommu@xxxxxxxxxxxxxxxxxxxxxxxxxx
> > > > > Cc: joro@xxxxxxxxxx; robin.murphy@xxxxxxx; jean-philippe@xxxxxxxxxx;
> > > > > will@xxxxxxxxxx; Zengtao (B) <prime.zeng@xxxxxxxxxxxxx>;
> > > > > linuxarm@xxxxxxxxxxxxx
> > > > > Subject: [Linuxarm] [PATCH v2] iommu: Check dev->iommu in
> > > iommu_dev_xxx
> > > > > functions
> > > > >
> > > > > The device iommu probe/attach might have failed leaving dev->iommu
> > > > > to NULL and device drivers may still invoke these functions resulting
> > > > > in a crash in iommu vendor driver code. Hence make sure we check that.
> > > > >
> > > > > Also added iommu_ops to the "struct dev_iommu" and set it if the dev
> > > > > is successfully associated with an iommu.
> > > > >
> > > > > Fixes: a3a195929d40 ("iommu: Add APIs for multiple domains per
> > device")
> > > > > Signed-off-by: Shameer Kolothum
> > > <shameerali.kolothum.thodi@xxxxxxxxxx>
> > > > > ---
> > > > > v1 --> v2:
> > > > >    -Added iommu_ops to struct dev_iommu based on the discussion with
> > > Robin.
> > > > >    -Rebased against iommu-tree core branch.
> > > >
> > > > A gentle ping on this...
> > >
> > > Is there a convincing justification for maintaining yet another copy of
> > > the ops pointer rather than simply dereferencing iommu_dev->ops at point
> > > of use?
> >
> > TBH, nothing I can think of now. That was mainly the way I interpreted your
> > suggestion
> > from the v1.  Now it looks like you didn’t mean it :). I am Ok to rework it to
> > dereference
> > it from iommu_dev. Please let me know.
>
> So we can do something like this,
>
> index fd76e2f579fe..5fd31a3cec18 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -2865,10 +2865,12 @@ EXPORT_SYMBOL_GPL(iommu_fwspec_add_ids);
>    */
>   int iommu_dev_enable_feature(struct device *dev, enum iommu_dev_features feat)
>   {
> -       const struct iommu_ops *ops = dev->bus->iommu_ops;
> +       if (dev->iommu && dev->iommu->iommu_dev && dev->iommu->iommu_dev->ops)
> +               struct iommu_ops  *ops = dev->iommu->iommu_dev->ops;
>   
> -       if (ops && ops->dev_enable_feat)
> -               return ops->dev_enable_feat(dev, feat);
> +               if (ops->dev_enable_feat)
> +                       return ops->dev_enable_feat(dev, feat);
> +       }
>   
>          return -ENODEV;
>   }
>
> Again, not sure we need to do the checking for iommu->dev and ops here. If the
> dev->iommu is set, is it safe to assume that we have a valid iommu->iommu_dev
> and ops always? (May be it is safer to do the checking in case something
> else breaks this assumption in future). Please let me know your thoughts.

I think it *could* happen that dev->iommu is set by iommu_fwspec_init() 
but iommu_probe_device() later refuses the device for whatever reason, 
so we would still need to check iommu->iommu_dev to be completely safe. 
We can assume iommu_dev->ops is valid, since if the IOMMU driver has 
returned something bogus from .probe_device then it's a major bug in 
that driver and crashing is the best indicator :)

Robin.

> Thanks,
> Shameer
>
>
> _______________________________________________
> iommu mailing list
> iommu@xxxxxxxxxxxxxxxxxxxxxxxxxx
> https://lists.linuxfoundation.org/mailman/listinfo/iommu