Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba826181 authored by VENKATA RAO KAKANI's avatar VENKATA RAO KAKANI Committed by Gerrit - the friendly Code Review server
Browse files

iommu/debug: Add mutex to make attach/detach thread safe 



This mutex lock will help to synchronise the usage of iommu domain
structure which is getting used by multiple threads to perform
iommu attach and iommu detach in case of any error.

Without this change we are seeing page poisoning - write after free
when running stress tests using iommu-debug test cases.

Change-Id: I388a90084ab8cc7e7097bac9a41ed5fed6dad312
Acked-by: default avatarAnkur Saxena <c_ankusa@qti.qualcomm.com>
Signed-off-by: default avatarVivek Gautam <vivek.gautam@codeaurora.org>
Signed-off-by: default avatarVENKATA RAO KAKANI <vkakani@codeaurora.org>
parent 1eef60bf

drivers/iommu/iommu-debug.c

+10 −0
Original line number Diff line number Diff line
@@ -1720,6 +1720,7 @@ static ssize_t iommu_debug_map_write(struct file *file, const char __user *ubuf, 
	if (kstrtoint(comma3 + 1, 0, &prot))

		goto invalid_format;



	mutex_lock(&ddev->dev_lock);

	ret = iommu_map(ddev->domain, iova, phys, size, prot);

	if (ret) {

		pr_err("iommu_map failed with %d\n", ret);
@@ -1731,6 +1732,7 @@ static ssize_t iommu_debug_map_write(struct file *file, const char __user *ubuf, 
	pr_err("Mapped %pa to %pa (len=0x%zx, prot=0x%x)\n",

	       &iova, &phys, size, prot);

out:

	mutex_unlock(&ddev->dev_lock);

	return retval;



invalid_format:
@@ -1818,14 +1820,17 @@ static ssize_t iommu_debug_dma_map_write(struct file *file, 
	else

		goto invalid_format;



	mutex_lock(&ddev->dev_lock);

	iova = dma_map_single_attrs(dev, v_addr, size,

					DMA_TO_DEVICE, dma_attrs);



	if (dma_mapping_error(dev, iova)) {

		pr_err("Failed to perform dma_map_single\n");

		ret = -EINVAL;

		mutex_unlock(&ddev->dev_lock);

		goto out;

	}

	mutex_unlock(&ddev->dev_lock);



	retval = count;

	pr_err("Mapped 0x%p to %pa (len=0x%zx)\n",
@@ -1932,12 +1937,15 @@ static ssize_t iommu_debug_unmap_write(struct file *file, 
	if (kstrtosize_t(comma1 + 1, 0, &size))

		goto invalid_format;



	mutex_lock(&ddev->dev_lock);

	unmapped = iommu_unmap(ddev->domain, iova, size);

	if (unmapped != size) {

		pr_err("iommu_unmap failed. Expected to unmap: 0x%zx, unmapped: 0x%zx",

		       size, unmapped);

		mutex_unlock(&ddev->dev_lock);

		return -EIO;

	}

	mutex_unlock(&ddev->dev_lock);



	retval = count;

	pr_err("Unmapped %pa (len=0x%zx)\n", &iova, size);
@@ -2023,7 +2031,9 @@ static ssize_t iommu_debug_dma_unmap_write(struct file *file, 
	else

		goto invalid_format;



	mutex_lock(&ddev->dev_lock);

	dma_unmap_single_attrs(dev, iova, size, DMA_TO_DEVICE, dma_attrs);

	mutex_unlock(&ddev->dev_lock);



	retval = count;

	pr_err("Unmapped %pa (len=0x%zx)\n", &iova, size);