Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu
Pull iommu fixes from Joerg Roedel:
- Warning fixes and a fix for a potential use-after-free in IOMMU core
code
- Another potential memory leak fix for the Intel VT-d driver
- Fix for an IO polling loop timeout issue in the AMD IOMMU driver
* tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
iommu: Fix some W=1 warnings
iommu: Fix potential use-after-free during probe
+33
-18
+2
drivers/iommu/amd/init.c
+2
drivers/iommu/amd/init.c
···
21
21
#include <linux/export.h>
22
22
#include <linux/kmemleak.h>
23
23
#include <linux/cc_platform.h>
24
+
#include <linux/iopoll.h>
24
25
#include <asm/pci-direct.h>
25
26
#include <asm/iommu.h>
26
27
#include <asm/apic.h>
···
835
834
status = readl(iommu->mmio_base + MMIO_STATUS_OFFSET);
836
835
if (status & (MMIO_STATUS_GALOG_RUN_MASK))
837
836
break;
837
+
udelay(10);
838
838
}
839
839
840
840
if (WARN_ON(i >= LOOP_TIMEOUT))
+10
-3
drivers/iommu/intel/irq_remapping.c
+10
-3
drivers/iommu/intel/irq_remapping.c
···
569
569
fn, &intel_ir_domain_ops,
570
570
iommu);
571
571
if (!iommu->ir_domain) {
572
-
irq_domain_free_fwnode(fn);
573
572
pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);
574
-
goto out_free_bitmap;
573
+
goto out_free_fwnode;
575
574
}
576
575
iommu->ir_msi_domain =
577
576
arch_create_remap_msi_irq_domain(iommu->ir_domain,
···
594
595
595
596
if (dmar_enable_qi(iommu)) {
596
597
pr_err("Failed to enable queued invalidation\n");
597
-
goto out_free_bitmap;
598
+
goto out_free_ir_domain;
598
599
}
599
600
}
600
601
···
618
619
619
620
return 0;
620
621
622
+
out_free_ir_domain:
623
+
if (iommu->ir_msi_domain)
624
+
irq_domain_remove(iommu->ir_msi_domain);
625
+
iommu->ir_msi_domain = NULL;
626
+
irq_domain_remove(iommu->ir_domain);
627
+
iommu->ir_domain = NULL;
628
+
out_free_fwnode:
629
+
irq_domain_free_fwnode(fn);
621
630
out_free_bitmap:
622
631
bitmap_free(bitmap);
623
632
out_free_pages:
+1
drivers/iommu/ioasid.c
+1
drivers/iommu/ioasid.c
+19
-14
drivers/iommu/iommu.c
+19
-14
drivers/iommu/iommu.c
···
207
207
208
208
static void dev_iommu_free(struct device *dev)
209
209
{
210
-
iommu_fwspec_free(dev);
211
-
kfree(dev->iommu);
210
+
struct dev_iommu *param = dev->iommu;
211
+
212
212
dev->iommu = NULL;
213
+
if (param->fwspec) {
214
+
fwnode_handle_put(param->fwspec->iommu_fwnode);
215
+
kfree(param->fwspec);
216
+
}
217
+
kfree(param);
213
218
}
214
219
215
220
static int __iommu_probe_device(struct device *dev, struct list_head *group_list)
···
985
980
return ret;
986
981
}
987
982
988
-
/**
989
-
* iommu_group_for_each_dev - iterate over each device in the group
990
-
* @group: the group
991
-
* @data: caller opaque data to be passed to callback function
992
-
* @fn: caller supplied callback function
993
-
*
994
-
* This function is called by group users to iterate over group devices.
995
-
* Callers should hold a reference count to the group during callback.
996
-
* The group->mutex is held across callbacks, which will block calls to
997
-
* iommu_group_add/remove_device.
998
-
*/
999
983
static int __iommu_group_for_each_dev(struct iommu_group *group, void *data,
1000
984
int (*fn)(struct device *, void *))
1001
985
{
···
999
1005
return ret;
1000
1006
}
1001
1007
1002
-
1008
+
/**
1009
+
* iommu_group_for_each_dev - iterate over each device in the group
1010
+
* @group: the group
1011
+
* @data: caller opaque data to be passed to callback function
1012
+
* @fn: caller supplied callback function
1013
+
*
1014
+
* This function is called by group users to iterate over group devices.
1015
+
* Callers should hold a reference count to the group during callback.
1016
+
* The group->mutex is held across callbacks, which will block calls to
1017
+
* iommu_group_add/remove_device.
1018
+
*/
1003
1019
int iommu_group_for_each_dev(struct iommu_group *group, void *data,
1004
1020
int (*fn)(struct device *, void *))
1005
1021
{
···
3036
3032
* iommu_sva_bind_device() - Bind a process address space to a device
3037
3033
* @dev: the device
3038
3034
* @mm: the mm to bind, caller must hold a reference to it
3035
+
* @drvdata: opaque data pointer to pass to bind callback
3039
3036
*
3040
3037
* Create a bond between device and address space, allowing the device to access
3041
3038
* the mm using the returned PASID. If a bond already exists between @device and
+1
-1
drivers/iommu/omap-iommu.c
+1
-1
drivers/iommu/omap-iommu.c
···
1085
1085
}
1086
1086
1087
1087
/**
1088
-
* omap_iommu_suspend_prepare - prepare() dev_pm_ops implementation
1088
+
* omap_iommu_prepare - prepare() dev_pm_ops implementation
1089
1089
* @dev: iommu device
1090
1090
*
1091
1091
* This function performs the necessary checks to determine if the IOMMU