From 52ed83d5c8c1240bb4510089bc8a169dee7661b6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 15 Jan 2023 08:59:24 +0100 Subject: [PATCH] 5.15-stable patches added patches: iommu-iova-fix-alloc-iova-overflows-issue.patch iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch --- ...-iova-fix-alloc-iova-overflows-issue.patch | 70 +++++++++++++++++++ ...-handling-path-in-mtk_iommu_v1_probe.patch | 47 +++++++++++++ queue-5.15/series | 2 + 3 files changed, 119 insertions(+) create mode 100644 queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch create mode 100644 queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch diff --git a/queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch b/queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch new file mode 100644 index 00000000000..6e78c9eadb2 --- /dev/null +++ b/queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch @@ -0,0 +1,70 @@ +From dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c Mon Sep 17 00:00:00 2001 +From: Yunfei Wang +Date: Wed, 11 Jan 2023 14:38:00 +0800 +Subject: iommu/iova: Fix alloc iova overflows issue + +From: Yunfei Wang + +commit dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c upstream. + +In __alloc_and_insert_iova_range, there is an issue that retry_pfn +overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when +iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will +overflow. As a result, if the retry logic is executed, low_pfn is +updated to 0, and then new_pfn < low_pfn returns false to make the +allocation successful. + +This issue occurs in the following two situations: +1. The first iova size exceeds the domain size. When initializing +iova domain, iovad->cached_node is assigned as iovad->anchor. For +example, the iova domain size is 10M, start_pfn is 0x1_F000_0000, +and the iova size allocated for the first time is 11M. The +following is the log information, new->pfn_lo is smaller than +iovad->cached_node. + +Example log as follows: +[ 223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range +start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 +[ 223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range +success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff + +2. The node with the largest iova->pfn_lo value in the iova domain +is deleted, iovad->cached_node will be updated to iovad->anchor, +and then the alloc iova size exceeds the maximum iova size that can +be allocated in the domain. + +After judging that retry_pfn is less than limit_pfn, call retry_pfn+1 +to fix the overflow issue. + +Signed-off-by: jianjiao zeng +Signed-off-by: Yunfei Wang +Cc: # 5.15.* +Fixes: 4e89dce72521 ("iommu/iova: Retry from last rb tree node if iova search fails") +Acked-by: Robin Murphy +Link: https://lore.kernel.org/r/20230111063801.25107-1-yf.wang@mediatek.com +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/iova.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -252,7 +252,7 @@ static int __alloc_and_insert_iova_range + + curr = __get_cached_rbnode(iovad, limit_pfn); + curr_iova = to_iova(curr); +- retry_pfn = curr_iova->pfn_hi + 1; ++ retry_pfn = curr_iova->pfn_hi; + + retry: + do { +@@ -266,7 +266,7 @@ retry: + if (high_pfn < size || new_pfn < low_pfn) { + if (low_pfn == iovad->start_pfn && retry_pfn < limit_pfn) { + high_pfn = limit_pfn; +- low_pfn = retry_pfn; ++ low_pfn = retry_pfn + 1; + curr = iova_find_limit(iovad, limit_pfn); + curr_iova = to_iova(curr); + goto retry; diff --git a/queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch b/queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch new file mode 100644 index 00000000000..ea41096bbb0 --- /dev/null +++ b/queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch @@ -0,0 +1,47 @@ +From 142e821f68cf5da79ce722cb9c1323afae30e185 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Mon, 19 Dec 2022 19:06:22 +0100 +Subject: iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() + +From: Christophe JAILLET + +commit 142e821f68cf5da79ce722cb9c1323afae30e185 upstream. + +A clk, prepared and enabled in mtk_iommu_v1_hw_init(), is not released in +the error handling path of mtk_iommu_v1_probe(). + +Add the corresponding clk_disable_unprepare(), as already done in the +remove function. + +Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW") +Signed-off-by: Christophe JAILLET +Reviewed-by: Yong Wu +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Matthias Brugger +Link: https://lore.kernel.org/r/593e7b7d97c6e064b29716b091a9d4fd122241fb.1671473163.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/mtk_iommu_v1.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/mtk_iommu_v1.c ++++ b/drivers/iommu/mtk_iommu_v1.c +@@ -655,7 +655,7 @@ static int mtk_iommu_probe(struct platfo + ret = iommu_device_sysfs_add(&data->iommu, &pdev->dev, NULL, + dev_name(&pdev->dev)); + if (ret) +- return ret; ++ goto out_clk_unprepare; + + ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev); + if (ret) +@@ -678,6 +678,8 @@ out_dev_unreg: + iommu_device_unregister(&data->iommu); + out_sysfs_remove: + iommu_device_sysfs_remove(&data->iommu); ++out_clk_unprepare: ++ clk_disable_unprepare(data->bclk); + return ret; + } + diff --git a/queue-5.15/series b/queue-5.15/series index 1f92db23370..585f4c53046 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -34,3 +34,5 @@ ixgbe-fix-pci-device-refcount-leak.patch ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch bus-mhi-host-fix-race-between-channel-preparation-an.patch usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch +iommu-iova-fix-alloc-iova-overflows-issue.patch +iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch -- 2.47.3