Messages in this thread Patch in this message | | | Date | Fri, 11 Aug 2017 19:02:36 +0200 (CEST) | From | Sebastian Ott <> | Subject | Re: [PATCH v3] iommu/s390: Add support for iommu_device handling |
| |
Hello Joerg,
On Fri, 11 Aug 2017, Joerg Roedel wrote: > Hey Sebastian, > > On Thu, Aug 10, 2017 at 09:07:06PM +0200, Sebastian Ott wrote: > > With this patch pci hot-unplug fails with a use after free or refcounting > > issue - I'm currently trying to understand what's going on... > > Let me know if I can help with debugging the issue, do you have a > backtrace for me to look at?
I would have send backtraces but everyone looked different: random mem corruptions, panic during unrelated allocations and stuff like that.
..but I found the bug, actually 2 bugs:
* That patch embedded a struct iommu_device within struct zpci_dev but the iommu_device has a release function (via its class) - so when the release function gets called it frees memory that was never allocated. The fix is to not embedd struct iommu_device in zpci_dev (see below)
* iommu_release_device must not release the struct device but the structure it is embedded in: struct iommu_device (I'll send a patch for that)
With these fixed it works fine.
Sebastian
--- arch/s390/include/asm/pci.h | 2 +- drivers/iommu/s390-iommu.c | 20 ++++++++++++-------- 2 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h index 386df9a..de3129e 100644 --- a/arch/s390/include/asm/pci.h +++ b/arch/s390/include/asm/pci.h @@ -123,7 +123,7 @@ struct zpci_dev { unsigned long iommu_pages; unsigned int next_bit; - struct iommu_device iommu_dev; /* IOMMU core handle */ + struct iommu_device *iommu_dev; /* IOMMU core handle */ char res_name[16]; struct zpci_bar_struct bars[PCI_BAR_COUNT]; diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c index 85f3bc5..58a7414 100644 --- a/drivers/iommu/s390-iommu.c +++ b/drivers/iommu/s390-iommu.c @@ -174,7 +174,7 @@ static int s390_iommu_add_device(struct device *dev) return PTR_ERR(group); iommu_group_put(group); - iommu_device_link(&zdev->iommu_dev, dev); + iommu_device_link(zdev->iommu_dev, dev); return 0; } @@ -201,7 +201,7 @@ static void s390_iommu_remove_device(struct device *dev) s390_iommu_detach_device(domain, dev); } - iommu_device_unlink(&zdev->iommu_dev, dev); + iommu_device_unlink(zdev->iommu_dev, dev); iommu_group_remove_device(dev); } @@ -336,21 +336,25 @@ int zpci_init_iommu(struct zpci_dev *zdev) { int rc = 0; - rc = iommu_device_sysfs_add(&zdev->iommu_dev, NULL, NULL, + zdev->iommu_dev = kzalloc(sizeof(*zdev->iommu_dev), GFP_KERNEL); + if (!zdev->iommu_dev) + return -ENOMEM; + + rc = iommu_device_sysfs_add(zdev->iommu_dev, NULL, NULL, "s390-iommu.%08x", zdev->fid); if (rc) goto out_err; - iommu_device_set_ops(&zdev->iommu_dev, &s390_iommu_ops); + iommu_device_set_ops(zdev->iommu_dev, &s390_iommu_ops); - rc = iommu_device_register(&zdev->iommu_dev); + rc = iommu_device_register(zdev->iommu_dev); if (rc) goto out_sysfs; return 0; out_sysfs: - iommu_device_sysfs_remove(&zdev->iommu_dev); + iommu_device_sysfs_remove(zdev->iommu_dev); out_err: return rc; @@ -358,8 +362,8 @@ int zpci_init_iommu(struct zpci_dev *zdev) void zpci_destroy_iommu(struct zpci_dev *zdev) { - iommu_device_unregister(&zdev->iommu_dev); - iommu_device_sysfs_remove(&zdev->iommu_dev); + iommu_device_unregister(zdev->iommu_dev); + iommu_device_sysfs_remove(zdev->iommu_dev); } static struct iommu_ops s390_iommu_ops = { -- 2.5.5
| |