Re: [PATCH v3 21/32] iommu/tegra-smmu: implement iova_to_phys_length

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Lockless page table access in `tegra_smmu_iova_to_phys_length` can race with concurrent `unmap` operations, resulting in a Use-After-Free (UAF) on the page table memory.
--

commit 8bec8e55c0ad853218bde06b33f63906725b5a20
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>

iommu/tegra-smmu: implement iova_to_phys_length

This commit implements the iova_to_phys_length callback for the Tegra
SMMU IOMMU driver. It returns the physical address and sets the mapped
length to 4K.

> diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
> index 67e7a7b925f0c..12f9bb623d874 100644
> --- a/drivers/iommu/tegra-smmu.c
> +++ b/drivers/iommu/tegra-smmu.c
[ ... ]
> @@ -813,10 +813,13 @@ static phys_addr_t tegra_smmu_iova_to_phys(struct iommu_domain *domain,
>  
>  	pte = tegra_smmu_pte_lookup(as, iova, &pte_dma);
>  	if (!pte || !*pte)

[Severity: High]
This isn't a bug introduced by this patch, but does this lockless page
table access race with concurrent unmap operations?

tegra_smmu_iova_to_phys_length() calls tegra_smmu_pte_lookup() without holding
as->lock. tegra_smmu_pte_lookup() retrieves a pointer to a PTE within a page
table. 

Concurrently, if an unmap operation for a different IOVA in the same page
table removes the last mapping, __tegra_smmu_unmap() (which holds the lock)
can call tegra_smmu_pte_put_use() to decrement the count and free the page
table via iommu_free_pages().

Could the lockless dereference of *pte here (and in the mask operation below)
read from freed page table memory if it races with such an unmap operation?
Should as->lock be held before calling tegra_smmu_pte_lookup() and across
the pointer dereference?

> -		return 0;
> +		return PHYS_ADDR_MAX;
>  
>  	pfn = *pte & as->smmu->pfn_mask;
>  
> +	if (mapped_length)
> +		*mapped_length = SZ_4K;
> +
>  	return SMMU_PFN_PHYS(pfn) + SMMU_OFFSET_IN_PAGE(iova);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260603151804.1963871-1-guanghuifeng@linux.alibaba.com?part=21