* drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173
@ 2025-10-30 5:08 kernel test robot
0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2025-10-30 5:08 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Julia Lawall
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Xu Yilun <yilun.xu@linux.intel.com>
CC: Jason Gunthorpe <jgg@ziepe.ca>
CC: Kevin Tian <kevin.tian@intel.com>
CC: Nicolin Chen <nicolinc@nvidia.com>
CC: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: e53642b87a4f4b03a8d7e5f8507fc3cd0c595ea6
commit: 850f14f5b91986e586b66565c9c75bdd4c834571 iommufd: Destroy vdevice on idevice destroy
date: 3 months ago
:::::: branch date: 28 hours ago
:::::: commit date: 3 months ago
config: x86_64-randconfig-r064-20251030 (https://download.01.org/0day-ci/archive/20251030/202510301327.ss7OGGT3-lkp@intel.com/config)
compiler: gcc-13 (Debian 13.3.0-16) 13.3.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Julia Lawall <julia.lawall@inria.fr>
| Closes: https://lore.kernel.org/r/202510301327.ss7OGGT3-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173
vim +252 drivers/iommu/iommufd/viommu.c
850f14f5b91986 Xu Yilun 2025-07-16 143
0ce5c2477af2e2 Nicolin Chen 2024-11-05 144 int iommufd_vdevice_alloc_ioctl(struct iommufd_ucmd *ucmd)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 145 {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 146 struct iommu_vdevice_alloc *cmd = ucmd->cmd;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 147 struct iommufd_vdevice *vdev, *curr;
ed42eee797ff3d Nicolin Chen 2025-07-09 148 size_t vdev_size = sizeof(*vdev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 149 struct iommufd_viommu *viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 150 struct iommufd_device *idev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 151 u64 virt_id = cmd->virt_id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 152 int rc = 0;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 153
0ce5c2477af2e2 Nicolin Chen 2024-11-05 154 /* virt_id indexes an xarray */
0ce5c2477af2e2 Nicolin Chen 2024-11-05 155 if (virt_id > ULONG_MAX)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 156 return -EINVAL;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 157
0ce5c2477af2e2 Nicolin Chen 2024-11-05 158 viommu = iommufd_get_viommu(ucmd, cmd->viommu_id);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 159 if (IS_ERR(viommu))
0ce5c2477af2e2 Nicolin Chen 2024-11-05 160 return PTR_ERR(viommu);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 161
0ce5c2477af2e2 Nicolin Chen 2024-11-05 162 idev = iommufd_get_device(ucmd, cmd->dev_id);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 163 if (IS_ERR(idev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 164 rc = PTR_ERR(idev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 165 goto out_put_viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 166 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 167
0ce5c2477af2e2 Nicolin Chen 2024-11-05 168 if (viommu->iommu_dev != __iommu_get_iommu_dev(idev->dev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 169 rc = -EINVAL;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 170 goto out_put_idev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 171 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 172
850f14f5b91986 Xu Yilun 2025-07-16 @173 mutex_lock(&idev->igroup->lock);
850f14f5b91986 Xu Yilun 2025-07-16 174 if (idev->destroying) {
850f14f5b91986 Xu Yilun 2025-07-16 175 rc = -ENOENT;
850f14f5b91986 Xu Yilun 2025-07-16 176 goto out_unlock_igroup;
850f14f5b91986 Xu Yilun 2025-07-16 177 }
850f14f5b91986 Xu Yilun 2025-07-16 178
850f14f5b91986 Xu Yilun 2025-07-16 179 if (idev->vdev) {
850f14f5b91986 Xu Yilun 2025-07-16 180 rc = -EEXIST;
850f14f5b91986 Xu Yilun 2025-07-16 181 goto out_unlock_igroup;
850f14f5b91986 Xu Yilun 2025-07-16 182 }
850f14f5b91986 Xu Yilun 2025-07-16 183
ed42eee797ff3d Nicolin Chen 2025-07-09 184 if (viommu->ops && viommu->ops->vdevice_size) {
ed42eee797ff3d Nicolin Chen 2025-07-09 185 /*
ed42eee797ff3d Nicolin Chen 2025-07-09 186 * It is a driver bug for:
ed42eee797ff3d Nicolin Chen 2025-07-09 187 * - ops->vdevice_size smaller than the core structure size
ed42eee797ff3d Nicolin Chen 2025-07-09 188 * - not implementing a pairing ops->vdevice_init op
ed42eee797ff3d Nicolin Chen 2025-07-09 189 */
ed42eee797ff3d Nicolin Chen 2025-07-09 190 if (WARN_ON_ONCE(viommu->ops->vdevice_size < vdev_size ||
ed42eee797ff3d Nicolin Chen 2025-07-09 191 !viommu->ops->vdevice_init)) {
ed42eee797ff3d Nicolin Chen 2025-07-09 192 rc = -EOPNOTSUPP;
ed42eee797ff3d Nicolin Chen 2025-07-09 193 goto out_put_idev;
ed42eee797ff3d Nicolin Chen 2025-07-09 194 }
ed42eee797ff3d Nicolin Chen 2025-07-09 195 vdev_size = viommu->ops->vdevice_size;
ed42eee797ff3d Nicolin Chen 2025-07-09 196 }
ed42eee797ff3d Nicolin Chen 2025-07-09 197
a64bae68adf1f8 Xu Yilun 2025-07-16 198 vdev = (struct iommufd_vdevice *)_iommufd_object_alloc(
a64bae68adf1f8 Xu Yilun 2025-07-16 199 ucmd->ictx, vdev_size, IOMMUFD_OBJ_VDEVICE);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 200 if (IS_ERR(vdev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 201 rc = PTR_ERR(vdev);
850f14f5b91986 Xu Yilun 2025-07-16 202 goto out_unlock_igroup;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 203 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 204
c50a5de2c46523 Nicolin Chen 2025-07-09 205 vdev->virt_id = virt_id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 206 vdev->dev = idev->dev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 207 get_device(idev->dev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 208 vdev->viommu = viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 209 refcount_inc(&viommu->obj.users);
850f14f5b91986 Xu Yilun 2025-07-16 210 /*
850f14f5b91986 Xu Yilun 2025-07-16 211 * A short term users reference is held on the idev so long as we have
850f14f5b91986 Xu Yilun 2025-07-16 212 * the pointer. iommufd_device_pre_destroy() will revoke it before the
850f14f5b91986 Xu Yilun 2025-07-16 213 * idev real destruction.
850f14f5b91986 Xu Yilun 2025-07-16 214 */
850f14f5b91986 Xu Yilun 2025-07-16 215 vdev->idev = idev;
850f14f5b91986 Xu Yilun 2025-07-16 216
850f14f5b91986 Xu Yilun 2025-07-16 217 /*
850f14f5b91986 Xu Yilun 2025-07-16 218 * iommufd_device_destroy() delays until idev->vdev is NULL before
850f14f5b91986 Xu Yilun 2025-07-16 219 * freeing the idev, which only happens once the vdev is finished
850f14f5b91986 Xu Yilun 2025-07-16 220 * destruction.
850f14f5b91986 Xu Yilun 2025-07-16 221 */
850f14f5b91986 Xu Yilun 2025-07-16 222 idev->vdev = vdev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 223
0ce5c2477af2e2 Nicolin Chen 2024-11-05 224 curr = xa_cmpxchg(&viommu->vdevs, virt_id, NULL, vdev, GFP_KERNEL);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 225 if (curr) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 226 rc = xa_err(curr) ?: -EEXIST;
a64bae68adf1f8 Xu Yilun 2025-07-16 227 goto out_abort;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 228 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 229
ed42eee797ff3d Nicolin Chen 2025-07-09 230 if (viommu->ops && viommu->ops->vdevice_init) {
ed42eee797ff3d Nicolin Chen 2025-07-09 231 rc = viommu->ops->vdevice_init(vdev);
ed42eee797ff3d Nicolin Chen 2025-07-09 232 if (rc)
a64bae68adf1f8 Xu Yilun 2025-07-16 233 goto out_abort;
ed42eee797ff3d Nicolin Chen 2025-07-09 234 }
ed42eee797ff3d Nicolin Chen 2025-07-09 235
0ce5c2477af2e2 Nicolin Chen 2024-11-05 236 cmd->out_vdevice_id = vdev->obj.id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 237 rc = iommufd_ucmd_respond(ucmd, sizeof(*cmd));
a64bae68adf1f8 Xu Yilun 2025-07-16 238 if (rc)
a64bae68adf1f8 Xu Yilun 2025-07-16 239 goto out_abort;
a64bae68adf1f8 Xu Yilun 2025-07-16 240 iommufd_object_finalize(ucmd->ictx, &vdev->obj);
850f14f5b91986 Xu Yilun 2025-07-16 241 goto out_unlock_igroup;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 242
a64bae68adf1f8 Xu Yilun 2025-07-16 243 out_abort:
a64bae68adf1f8 Xu Yilun 2025-07-16 244 iommufd_object_abort_and_destroy(ucmd->ictx, &vdev->obj);
850f14f5b91986 Xu Yilun 2025-07-16 245 out_unlock_igroup:
850f14f5b91986 Xu Yilun 2025-07-16 246 mutex_unlock(&idev->igroup->lock);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 247 out_put_idev:
850f14f5b91986 Xu Yilun 2025-07-16 248 if (rc)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 249 iommufd_put_object(ucmd->ictx, &idev->obj);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 250 out_put_viommu:
0ce5c2477af2e2 Nicolin Chen 2024-11-05 251 iommufd_put_object(ucmd->ictx, &viommu->obj);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 @252 return rc;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 253 }
2238ddc2b05607 Nicolin Chen 2025-07-09 254
:::::: The code at line 252 was first introduced by commit
:::::: 0ce5c2477af2e2284b9c70474e4dae85db211680 iommufd/viommu: Add IOMMUFD_OBJ_VDEVICE and IOMMU_VDEVICE_ALLOC ioctl
:::::: TO: Nicolin Chen <nicolinc@nvidia.com>
:::::: CC: Jason Gunthorpe <jgg@nvidia.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173
@ 2026-02-17 8:47 kernel test robot
0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-02-17 8:47 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Julia Lawall
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Xu Yilun <yilun.xu@linux.intel.com>
CC: Jason Gunthorpe <jgg@ziepe.ca>
CC: Kevin Tian <kevin.tian@intel.com>
CC: Nicolin Chen <nicolinc@nvidia.com>
CC: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 9702969978695d9a699a1f34771580cdbb153b33
commit: 850f14f5b91986e586b66565c9c75bdd4c834571 iommufd: Destroy vdevice on idevice destroy
date: 7 months ago
:::::: branch date: 11 hours ago
:::::: commit date: 7 months ago
config: mips-randconfig-r064-20260215 (https://download.01.org/0day-ci/archive/20260217/202602171657.jdIZ2IFl-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Julia Lawall <julia.lawall@inria.fr>
| Closes: https://lore.kernel.org/r/202602171657.jdIZ2IFl-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173
vim +252 drivers/iommu/iommufd/viommu.c
850f14f5b91986 Xu Yilun 2025-07-16 143
0ce5c2477af2e2 Nicolin Chen 2024-11-05 144 int iommufd_vdevice_alloc_ioctl(struct iommufd_ucmd *ucmd)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 145 {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 146 struct iommu_vdevice_alloc *cmd = ucmd->cmd;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 147 struct iommufd_vdevice *vdev, *curr;
ed42eee797ff3d Nicolin Chen 2025-07-09 148 size_t vdev_size = sizeof(*vdev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 149 struct iommufd_viommu *viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 150 struct iommufd_device *idev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 151 u64 virt_id = cmd->virt_id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 152 int rc = 0;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 153
0ce5c2477af2e2 Nicolin Chen 2024-11-05 154 /* virt_id indexes an xarray */
0ce5c2477af2e2 Nicolin Chen 2024-11-05 155 if (virt_id > ULONG_MAX)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 156 return -EINVAL;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 157
0ce5c2477af2e2 Nicolin Chen 2024-11-05 158 viommu = iommufd_get_viommu(ucmd, cmd->viommu_id);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 159 if (IS_ERR(viommu))
0ce5c2477af2e2 Nicolin Chen 2024-11-05 160 return PTR_ERR(viommu);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 161
0ce5c2477af2e2 Nicolin Chen 2024-11-05 162 idev = iommufd_get_device(ucmd, cmd->dev_id);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 163 if (IS_ERR(idev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 164 rc = PTR_ERR(idev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 165 goto out_put_viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 166 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 167
0ce5c2477af2e2 Nicolin Chen 2024-11-05 168 if (viommu->iommu_dev != __iommu_get_iommu_dev(idev->dev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 169 rc = -EINVAL;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 170 goto out_put_idev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 171 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 172
850f14f5b91986 Xu Yilun 2025-07-16 @173 mutex_lock(&idev->igroup->lock);
850f14f5b91986 Xu Yilun 2025-07-16 174 if (idev->destroying) {
850f14f5b91986 Xu Yilun 2025-07-16 175 rc = -ENOENT;
850f14f5b91986 Xu Yilun 2025-07-16 176 goto out_unlock_igroup;
850f14f5b91986 Xu Yilun 2025-07-16 177 }
850f14f5b91986 Xu Yilun 2025-07-16 178
850f14f5b91986 Xu Yilun 2025-07-16 179 if (idev->vdev) {
850f14f5b91986 Xu Yilun 2025-07-16 180 rc = -EEXIST;
850f14f5b91986 Xu Yilun 2025-07-16 181 goto out_unlock_igroup;
850f14f5b91986 Xu Yilun 2025-07-16 182 }
850f14f5b91986 Xu Yilun 2025-07-16 183
ed42eee797ff3d Nicolin Chen 2025-07-09 184 if (viommu->ops && viommu->ops->vdevice_size) {
ed42eee797ff3d Nicolin Chen 2025-07-09 185 /*
ed42eee797ff3d Nicolin Chen 2025-07-09 186 * It is a driver bug for:
ed42eee797ff3d Nicolin Chen 2025-07-09 187 * - ops->vdevice_size smaller than the core structure size
ed42eee797ff3d Nicolin Chen 2025-07-09 188 * - not implementing a pairing ops->vdevice_init op
ed42eee797ff3d Nicolin Chen 2025-07-09 189 */
ed42eee797ff3d Nicolin Chen 2025-07-09 190 if (WARN_ON_ONCE(viommu->ops->vdevice_size < vdev_size ||
ed42eee797ff3d Nicolin Chen 2025-07-09 191 !viommu->ops->vdevice_init)) {
ed42eee797ff3d Nicolin Chen 2025-07-09 192 rc = -EOPNOTSUPP;
ed42eee797ff3d Nicolin Chen 2025-07-09 193 goto out_put_idev;
ed42eee797ff3d Nicolin Chen 2025-07-09 194 }
ed42eee797ff3d Nicolin Chen 2025-07-09 195 vdev_size = viommu->ops->vdevice_size;
ed42eee797ff3d Nicolin Chen 2025-07-09 196 }
ed42eee797ff3d Nicolin Chen 2025-07-09 197
a64bae68adf1f8 Xu Yilun 2025-07-16 198 vdev = (struct iommufd_vdevice *)_iommufd_object_alloc(
a64bae68adf1f8 Xu Yilun 2025-07-16 199 ucmd->ictx, vdev_size, IOMMUFD_OBJ_VDEVICE);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 200 if (IS_ERR(vdev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 201 rc = PTR_ERR(vdev);
850f14f5b91986 Xu Yilun 2025-07-16 202 goto out_unlock_igroup;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 203 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 204
c50a5de2c46523 Nicolin Chen 2025-07-09 205 vdev->virt_id = virt_id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 206 vdev->dev = idev->dev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 207 get_device(idev->dev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 208 vdev->viommu = viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 209 refcount_inc(&viommu->obj.users);
850f14f5b91986 Xu Yilun 2025-07-16 210 /*
850f14f5b91986 Xu Yilun 2025-07-16 211 * A short term users reference is held on the idev so long as we have
850f14f5b91986 Xu Yilun 2025-07-16 212 * the pointer. iommufd_device_pre_destroy() will revoke it before the
850f14f5b91986 Xu Yilun 2025-07-16 213 * idev real destruction.
850f14f5b91986 Xu Yilun 2025-07-16 214 */
850f14f5b91986 Xu Yilun 2025-07-16 215 vdev->idev = idev;
850f14f5b91986 Xu Yilun 2025-07-16 216
850f14f5b91986 Xu Yilun 2025-07-16 217 /*
850f14f5b91986 Xu Yilun 2025-07-16 218 * iommufd_device_destroy() delays until idev->vdev is NULL before
850f14f5b91986 Xu Yilun 2025-07-16 219 * freeing the idev, which only happens once the vdev is finished
850f14f5b91986 Xu Yilun 2025-07-16 220 * destruction.
850f14f5b91986 Xu Yilun 2025-07-16 221 */
850f14f5b91986 Xu Yilun 2025-07-16 222 idev->vdev = vdev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 223
0ce5c2477af2e2 Nicolin Chen 2024-11-05 224 curr = xa_cmpxchg(&viommu->vdevs, virt_id, NULL, vdev, GFP_KERNEL);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 225 if (curr) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 226 rc = xa_err(curr) ?: -EEXIST;
a64bae68adf1f8 Xu Yilun 2025-07-16 227 goto out_abort;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 228 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 229
ed42eee797ff3d Nicolin Chen 2025-07-09 230 if (viommu->ops && viommu->ops->vdevice_init) {
ed42eee797ff3d Nicolin Chen 2025-07-09 231 rc = viommu->ops->vdevice_init(vdev);
ed42eee797ff3d Nicolin Chen 2025-07-09 232 if (rc)
a64bae68adf1f8 Xu Yilun 2025-07-16 233 goto out_abort;
ed42eee797ff3d Nicolin Chen 2025-07-09 234 }
ed42eee797ff3d Nicolin Chen 2025-07-09 235
0ce5c2477af2e2 Nicolin Chen 2024-11-05 236 cmd->out_vdevice_id = vdev->obj.id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 237 rc = iommufd_ucmd_respond(ucmd, sizeof(*cmd));
a64bae68adf1f8 Xu Yilun 2025-07-16 238 if (rc)
a64bae68adf1f8 Xu Yilun 2025-07-16 239 goto out_abort;
a64bae68adf1f8 Xu Yilun 2025-07-16 240 iommufd_object_finalize(ucmd->ictx, &vdev->obj);
850f14f5b91986 Xu Yilun 2025-07-16 241 goto out_unlock_igroup;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 242
a64bae68adf1f8 Xu Yilun 2025-07-16 243 out_abort:
a64bae68adf1f8 Xu Yilun 2025-07-16 244 iommufd_object_abort_and_destroy(ucmd->ictx, &vdev->obj);
850f14f5b91986 Xu Yilun 2025-07-16 245 out_unlock_igroup:
850f14f5b91986 Xu Yilun 2025-07-16 246 mutex_unlock(&idev->igroup->lock);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 247 out_put_idev:
850f14f5b91986 Xu Yilun 2025-07-16 248 if (rc)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 249 iommufd_put_object(ucmd->ictx, &idev->obj);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 250 out_put_viommu:
0ce5c2477af2e2 Nicolin Chen 2024-11-05 251 iommufd_put_object(ucmd->ictx, &viommu->obj);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 @252 return rc;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 253 }
2238ddc2b05607 Nicolin Chen 2025-07-09 254
:::::: The code at line 252 was first introduced by commit
:::::: 0ce5c2477af2e2284b9c70474e4dae85db211680 iommufd/viommu: Add IOMMUFD_OBJ_VDEVICE and IOMMU_VDEVICE_ALLOC ioctl
:::::: TO: Nicolin Chen <nicolinc@nvidia.com>
:::::: CC: Jason Gunthorpe <jgg@nvidia.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173
@ 2026-06-02 19:15 kernel test robot
0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-06-02 19:15 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Julia Lawall
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Xu Yilun <yilun.xu@linux.intel.com>
CC: Jason Gunthorpe <jgg@ziepe.ca>
CC: Kevin Tian <kevin.tian@intel.com>
CC: Nicolin Chen <nicolinc@nvidia.com>
CC: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 6f3ed7fec72fc8979b2a8c7219c0a9fcfc8d07b5
commit: 850f14f5b91986e586b66565c9c75bdd4c834571 iommufd: Destroy vdevice on idevice destroy
date: 11 months ago
:::::: branch date: 16 hours ago
:::::: commit date: 11 months ago
config: hexagon-randconfig-r064-20260601 (https://download.01.org/0day-ci/archive/20260603/202606030229.XMfNZtC1-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 9409c07de6378507397ecdb6f05f628f58110112)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 850f14f5b919 ("iommufd: Destroy vdevice on idevice destroy")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Julia Lawall <julia.lawall@inria.fr>
| Closes: https://lore.kernel.org/r/202606030229.XMfNZtC1-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173
vim +252 drivers/iommu/iommufd/viommu.c
850f14f5b91986 Xu Yilun 2025-07-16 143
0ce5c2477af2e2 Nicolin Chen 2024-11-05 144 int iommufd_vdevice_alloc_ioctl(struct iommufd_ucmd *ucmd)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 145 {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 146 struct iommu_vdevice_alloc *cmd = ucmd->cmd;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 147 struct iommufd_vdevice *vdev, *curr;
ed42eee797ff3d Nicolin Chen 2025-07-09 148 size_t vdev_size = sizeof(*vdev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 149 struct iommufd_viommu *viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 150 struct iommufd_device *idev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 151 u64 virt_id = cmd->virt_id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 152 int rc = 0;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 153
0ce5c2477af2e2 Nicolin Chen 2024-11-05 154 /* virt_id indexes an xarray */
0ce5c2477af2e2 Nicolin Chen 2024-11-05 155 if (virt_id > ULONG_MAX)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 156 return -EINVAL;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 157
0ce5c2477af2e2 Nicolin Chen 2024-11-05 158 viommu = iommufd_get_viommu(ucmd, cmd->viommu_id);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 159 if (IS_ERR(viommu))
0ce5c2477af2e2 Nicolin Chen 2024-11-05 160 return PTR_ERR(viommu);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 161
0ce5c2477af2e2 Nicolin Chen 2024-11-05 162 idev = iommufd_get_device(ucmd, cmd->dev_id);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 163 if (IS_ERR(idev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 164 rc = PTR_ERR(idev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 165 goto out_put_viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 166 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 167
0ce5c2477af2e2 Nicolin Chen 2024-11-05 168 if (viommu->iommu_dev != __iommu_get_iommu_dev(idev->dev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 169 rc = -EINVAL;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 170 goto out_put_idev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 171 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 172
850f14f5b91986 Xu Yilun 2025-07-16 @173 mutex_lock(&idev->igroup->lock);
850f14f5b91986 Xu Yilun 2025-07-16 174 if (idev->destroying) {
850f14f5b91986 Xu Yilun 2025-07-16 175 rc = -ENOENT;
850f14f5b91986 Xu Yilun 2025-07-16 176 goto out_unlock_igroup;
850f14f5b91986 Xu Yilun 2025-07-16 177 }
850f14f5b91986 Xu Yilun 2025-07-16 178
850f14f5b91986 Xu Yilun 2025-07-16 179 if (idev->vdev) {
850f14f5b91986 Xu Yilun 2025-07-16 180 rc = -EEXIST;
850f14f5b91986 Xu Yilun 2025-07-16 181 goto out_unlock_igroup;
850f14f5b91986 Xu Yilun 2025-07-16 182 }
850f14f5b91986 Xu Yilun 2025-07-16 183
ed42eee797ff3d Nicolin Chen 2025-07-09 184 if (viommu->ops && viommu->ops->vdevice_size) {
ed42eee797ff3d Nicolin Chen 2025-07-09 185 /*
ed42eee797ff3d Nicolin Chen 2025-07-09 186 * It is a driver bug for:
ed42eee797ff3d Nicolin Chen 2025-07-09 187 * - ops->vdevice_size smaller than the core structure size
ed42eee797ff3d Nicolin Chen 2025-07-09 188 * - not implementing a pairing ops->vdevice_init op
ed42eee797ff3d Nicolin Chen 2025-07-09 189 */
ed42eee797ff3d Nicolin Chen 2025-07-09 190 if (WARN_ON_ONCE(viommu->ops->vdevice_size < vdev_size ||
ed42eee797ff3d Nicolin Chen 2025-07-09 191 !viommu->ops->vdevice_init)) {
ed42eee797ff3d Nicolin Chen 2025-07-09 192 rc = -EOPNOTSUPP;
ed42eee797ff3d Nicolin Chen 2025-07-09 193 goto out_put_idev;
ed42eee797ff3d Nicolin Chen 2025-07-09 194 }
ed42eee797ff3d Nicolin Chen 2025-07-09 195 vdev_size = viommu->ops->vdevice_size;
ed42eee797ff3d Nicolin Chen 2025-07-09 196 }
ed42eee797ff3d Nicolin Chen 2025-07-09 197
a64bae68adf1f8 Xu Yilun 2025-07-16 198 vdev = (struct iommufd_vdevice *)_iommufd_object_alloc(
a64bae68adf1f8 Xu Yilun 2025-07-16 199 ucmd->ictx, vdev_size, IOMMUFD_OBJ_VDEVICE);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 200 if (IS_ERR(vdev)) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 201 rc = PTR_ERR(vdev);
850f14f5b91986 Xu Yilun 2025-07-16 202 goto out_unlock_igroup;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 203 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 204
c50a5de2c46523 Nicolin Chen 2025-07-09 205 vdev->virt_id = virt_id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 206 vdev->dev = idev->dev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 207 get_device(idev->dev);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 208 vdev->viommu = viommu;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 209 refcount_inc(&viommu->obj.users);
850f14f5b91986 Xu Yilun 2025-07-16 210 /*
850f14f5b91986 Xu Yilun 2025-07-16 211 * A short term users reference is held on the idev so long as we have
850f14f5b91986 Xu Yilun 2025-07-16 212 * the pointer. iommufd_device_pre_destroy() will revoke it before the
850f14f5b91986 Xu Yilun 2025-07-16 213 * idev real destruction.
850f14f5b91986 Xu Yilun 2025-07-16 214 */
850f14f5b91986 Xu Yilun 2025-07-16 215 vdev->idev = idev;
850f14f5b91986 Xu Yilun 2025-07-16 216
850f14f5b91986 Xu Yilun 2025-07-16 217 /*
850f14f5b91986 Xu Yilun 2025-07-16 218 * iommufd_device_destroy() delays until idev->vdev is NULL before
850f14f5b91986 Xu Yilun 2025-07-16 219 * freeing the idev, which only happens once the vdev is finished
850f14f5b91986 Xu Yilun 2025-07-16 220 * destruction.
850f14f5b91986 Xu Yilun 2025-07-16 221 */
850f14f5b91986 Xu Yilun 2025-07-16 222 idev->vdev = vdev;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 223
0ce5c2477af2e2 Nicolin Chen 2024-11-05 224 curr = xa_cmpxchg(&viommu->vdevs, virt_id, NULL, vdev, GFP_KERNEL);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 225 if (curr) {
0ce5c2477af2e2 Nicolin Chen 2024-11-05 226 rc = xa_err(curr) ?: -EEXIST;
a64bae68adf1f8 Xu Yilun 2025-07-16 227 goto out_abort;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 228 }
0ce5c2477af2e2 Nicolin Chen 2024-11-05 229
ed42eee797ff3d Nicolin Chen 2025-07-09 230 if (viommu->ops && viommu->ops->vdevice_init) {
ed42eee797ff3d Nicolin Chen 2025-07-09 231 rc = viommu->ops->vdevice_init(vdev);
ed42eee797ff3d Nicolin Chen 2025-07-09 232 if (rc)
a64bae68adf1f8 Xu Yilun 2025-07-16 233 goto out_abort;
ed42eee797ff3d Nicolin Chen 2025-07-09 234 }
ed42eee797ff3d Nicolin Chen 2025-07-09 235
0ce5c2477af2e2 Nicolin Chen 2024-11-05 236 cmd->out_vdevice_id = vdev->obj.id;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 237 rc = iommufd_ucmd_respond(ucmd, sizeof(*cmd));
a64bae68adf1f8 Xu Yilun 2025-07-16 238 if (rc)
a64bae68adf1f8 Xu Yilun 2025-07-16 239 goto out_abort;
a64bae68adf1f8 Xu Yilun 2025-07-16 240 iommufd_object_finalize(ucmd->ictx, &vdev->obj);
850f14f5b91986 Xu Yilun 2025-07-16 241 goto out_unlock_igroup;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 242
a64bae68adf1f8 Xu Yilun 2025-07-16 243 out_abort:
a64bae68adf1f8 Xu Yilun 2025-07-16 244 iommufd_object_abort_and_destroy(ucmd->ictx, &vdev->obj);
850f14f5b91986 Xu Yilun 2025-07-16 245 out_unlock_igroup:
850f14f5b91986 Xu Yilun 2025-07-16 246 mutex_unlock(&idev->igroup->lock);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 247 out_put_idev:
850f14f5b91986 Xu Yilun 2025-07-16 248 if (rc)
0ce5c2477af2e2 Nicolin Chen 2024-11-05 249 iommufd_put_object(ucmd->ictx, &idev->obj);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 250 out_put_viommu:
0ce5c2477af2e2 Nicolin Chen 2024-11-05 251 iommufd_put_object(ucmd->ictx, &viommu->obj);
0ce5c2477af2e2 Nicolin Chen 2024-11-05 @252 return rc;
0ce5c2477af2e2 Nicolin Chen 2024-11-05 253 }
2238ddc2b05607 Nicolin Chen 2025-07-09 254
:::::: The code at line 252 was first introduced by commit
:::::: 0ce5c2477af2e2284b9c70474e4dae85db211680 iommufd/viommu: Add IOMMUFD_OBJ_VDEVICE and IOMMU_VDEVICE_ALLOC ioctl
:::::: TO: Nicolin Chen <nicolinc@nvidia.com>
:::::: CC: Jason Gunthorpe <jgg@nvidia.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-02 19:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-30 5:08 drivers/iommu/iommufd/viommu.c:252:1-7: preceding lock on line 173 kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2026-02-17 8:47 kernel test robot
2026-06-02 19:15 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.