torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

IOMMU Fixes for Linux v6.17-rc2:

Browse Source 
Including:
 
 	- AMD-Vi: Fix potential stack buffer overflow via command line.
 
 	- NVidia-Tegra: Fix endianess sparse warning.
 
 	- ARM-SMMU: Fix ATS-masters reference count issue.
 
 	- Virtio-IOMMU: Fix race condition on instance lookup.
 
 	- RISC-V IOMMU: Fix potential NULL-ptr dereference in
 	  riscv_iommu_iova_to_phys().
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmioMvgACgkQK/BELZcB
 GuMzlxAAh1sQ3jPkyEcQzCErCYvvICWMzEiV0Lweot5xBFcAZAXQEcYJy9u1PnA7
 NNoSfhaEyufkANUznvI5ikkJzv9wfIOK1mn3vjaeZe7ymXqh0m+JqFWS1hQynjp4
 6DEIYEJLB1pLDM41P+S+AnVWfS88XwMsUd13es773zJgPLHfK9U97oFWfUhkj6ei
 9ItvgSAiqAcIPYu1/hI5Te7vIC5RBRyOfvAhhzxx2255T3bdUqbVUz3ERLXZ808M
 MOmhznlVAChhoOKTdWRpOaVnFsaWCbUBhdnnSwwL7lsmixd4wDELZM/8jGA8hlIT
 7sbMIiiEdWqPfpMZxDuz7IfEilhFmZP8+e5c8VPL37PTouj2RdCGPbLtzGFzlMKU
 QF40K6FAJCbE9mmgmtdD33xhBkc3/7gar9Xvc3k9VEvVOfvZ/TxgPTW4ZilaO+OK
 C8S1/x3T6MFZmndKT/H1SAm+AM4pViON48N5t4L6rVA/na0xraOXNjFnsNeK6gLY
 lK5pz7St69Ud7KQUQXhUgKSktDDQOnZYcbn0I7z2KfSAIWFxqJgT9F5XtTde1kdm
 XZVe4qp59UzOgZQu1Q1K5F2peQGFSjoaK69r4I0Mh2VY7jokW/tZmqUgyTbW42hD
 qH/jhcPblpOTCFM9LPn94oShmTlMcNhKYbfO+VKIY9ThhxPVHJc=
 =BWSF
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

Pull iommu fixes from Joerg Roedel:

 - AMD-Vi: Fix potential stack buffer overflow via command line

 - NVidia-Tegra: Fix endianess sparse warning

 - ARM-SMMU: Fix ATS-masters reference count issue

 - Virtio-IOMMU: Fix race condition on instance lookup

 - RISC-V IOMMU: Fix potential NULL-ptr dereference in
   riscv_iommu_iova_to_phys()

* tag 'iommu-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/riscv: prevent NULL deref in iova_to_phys
  iommu/virtio: Make instance lookup robust
  iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
  iommu/tegra241-cmdqv: Fix missing cpu_to_le64 at lvcmdq_err_map
  iommu/amd: Avoid stack buffer overflow from kernel cmdline
This commit is contained in:
Linus Torvalds 2025-08-22 09:10:30 -04:00
commit c37d2bc92b
5 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/iommu/amd/init.c
View File

@ -3638,7 +3638,7 @@ static int __init parse_ivrs_acpihid(char *str)
{
u32 seg = 0, bus, dev, fn;
char *hid, *uid, *p, *addr;
char acpiid[ACPIID_LEN] = {0};
char acpiid[ACPIID_LEN + 1] = { }; /* size with NULL terminator */
int i;
addr = strchr(str, '@');
@ -3664,7 +3664,7 @@ static int __init parse_ivrs_acpihid(char *str)
/* We have the '@', make it the terminator to get just the acpiid */
*addr++ = 0;
if (strlen(str) > ACPIID_LEN + 1)
if (strlen(str) > ACPIID_LEN)
goto not_found;
if (sscanf(str, "=%s", acpiid) != 1)

2
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
View File

@ -2997,9 +2997,9 @@ void arm_smmu_attach_commit(struct arm_smmu_attach_state *state)
/* ATS is being switched off, invalidate the entire ATC */
arm_smmu_atc_inv_master(master, IOMMU_NO_PASID);
}
master->ats_enabled = state->ats_enabled;
arm_smmu_remove_master_domain(master, state->old_domain, state->ssid);
master->ats_enabled = state->ats_enabled;
}
static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)

8
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
View File

@ -301,9 +301,11 @@ static void tegra241_vintf_user_handle_error(struct tegra241_vintf *vintf)
struct iommu_vevent_tegra241_cmdqv vevent_data;
int i;
for (i = 0; i < LVCMDQ_ERR_MAP_NUM_64; i++)
vevent_data.lvcmdq_err_map[i] =
readq_relaxed(REG_VINTF(vintf, LVCMDQ_ERR_MAP_64(i)));
for (i = 0; i < LVCMDQ_ERR_MAP_NUM_64; i++) {
u64 err = readq_relaxed(REG_VINTF(vintf, LVCMDQ_ERR_MAP_64(i)));
vevent_data.lvcmdq_err_map[i] = cpu_to_le64(err);
}
iommufd_viommu_report_event(viommu, IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV,
&vevent_data, sizeof(vevent_data));

2
drivers/iommu/riscv/iommu.c
View File

@ -1283,7 +1283,7 @@ static phys_addr_t riscv_iommu_iova_to_phys(struct iommu_domain *iommu_domain,
unsigned long *ptr;
ptr = riscv_iommu_pte_fetch(domain, iova, &pte_size);
if (_io_pte_none(*ptr) || !_io_pte_present(*ptr))
if (!ptr)
return 0;
return pfn_to_phys(__page_val_to_pfn(*ptr)) | (iova & (pte_size - 1));

15
drivers/iommu/virtio-iommu.c
View File

@ -998,8 +998,7 @@ static void viommu_get_resv_regions(struct device *dev, struct list_head *head)
iommu_dma_get_resv_regions(dev, head);
}
static const struct iommu_ops viommu_ops;
static struct virtio_driver virtio_iommu_drv;
static const struct bus_type *virtio_bus_type;
static int viommu_match_node(struct device *dev, const void *data)
{
@ -1008,8 +1007,9 @@ static int viommu_match_node(struct device *dev, const void *data)
static struct viommu_dev *viommu_get_by_fwnode(struct fwnode_handle *fwnode)
{
struct device *dev = driver_find_device(&virtio_iommu_drv.driver, NULL,
fwnode, viommu_match_node);
struct device *dev = bus_find_device(virtio_bus_type, NULL, fwnode,
viommu_match_node);
put_device(dev);
return dev ? dev_to_virtio(dev)->priv : NULL;
@ -1160,6 +1160,9 @@ static int viommu_probe(struct virtio_device *vdev)
if (!viommu)
return -ENOMEM;
/* Borrow this for easy lookups later */
virtio_bus_type = dev->bus;
spin_lock_init(&viommu->request_lock);
ida_init(&viommu->domain_ids);
viommu->dev = dev;
@ -1229,10 +1232,10 @@ static int viommu_probe(struct virtio_device *vdev)
if (ret)
goto err_free_vqs;
iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
vdev->priv = viommu;
iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
dev_info(dev, "input address: %u bits\n",
order_base_2(viommu->geometry.aperture_end));
dev_info(dev, "page mask: %#llx\n", viommu->pgsize_bitmap);