[PATCH] iommu/intel: Prevent variable pollution in cache_tag_flush_range()

[PATCH] iommu/intel: Prevent variable pollution in cache_tag_flush_range()

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

The loop in cache_tag_flush_range() modifies local 'addr' and 'mask'
variables that persist across iterations. When CACHE_TAG_NESTING_DEVTLB
overrides them for a full flush and falls through, subsequent tags
incorrectly receive the modified values instead of the original range.

Fix by creating per-iteration local copies initialized from the original
parameters, ensuring each tag processes the intended flush range.

Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/iommu/intel/cache.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c
index fdc8881..9253025 100644
--- a/drivers/iommu/intel/cache.c
+++ b/drivers/iommu/intel/cache.c
@@ -437,6 +437,9 @@ void cache_tag_flush_range(struct dmar_domain *domain, unsigned long start,
 
 	spin_lock_irqsave(&domain->cache_lock, flags);
 	list_for_each_entry(tag, &domain->cache_tags, node) {
+		unsigned long flush_addr = addr;
+		unsigned long flush_mask = mask;
+
 		if (iommu && iommu != tag->iommu)
 			qi_batch_flush_descs(iommu, domain->qi_batch);
 		iommu = tag->iommu;
@@ -444,7 +447,7 @@ void cache_tag_flush_range(struct dmar_domain *domain, unsigned long start,
 		switch (tag->type) {
 		case CACHE_TAG_IOTLB:
 		case CACHE_TAG_NESTING_IOTLB:
-			cache_tag_flush_iotlb(domain, tag, addr, mask, ih);
+			cache_tag_flush_iotlb(domain, tag, flush_addr, flush_mask, ih);
 			break;
 		case CACHE_TAG_NESTING_DEVTLB:
 			/*
@@ -454,15 +457,15 @@ void cache_tag_flush_range(struct dmar_domain *domain, unsigned long start,
 			 * affected by a change in S2. So just flush the entire
 			 * device cache.
 			 */
-			addr = 0;
-			mask = MAX_AGAW_PFN_WIDTH;
+			flush_addr = 0;
+			flush_mask = MAX_AGAW_PFN_WIDTH;
 			fallthrough;
 		case CACHE_TAG_DEVTLB:
-			cache_tag_flush_devtlb_psi(domain, tag, addr, mask);
+			cache_tag_flush_devtlb_psi(domain, tag, flush_addr, flush_mask);
 			break;
 		}
 
-		trace_cache_tag_flush_range(tag, start, end, addr, mask);
+		trace_cache_tag_flush_range(tag, start, end, flush_addr, flush_mask);
 	}
 	qi_batch_flush_descs(iommu, domain->qi_batch);
 	spin_unlock_irqrestore(&domain->cache_lock, flags);
-- 
2.9.4

答复: [PATCH] iommu/intel: Prevent variable pollution in cache_tag_flush_range()

[Li,Rongqing]

> 
> From: Li RongQing <lirongqing@baidu.com>
> 
> The loop in cache_tag_flush_range() modifies local 'addr' and 'mask'
> variables that persist across iterations. When CACHE_TAG_NESTING_DEVTLB
> overrides them for a full flush and falls through, subsequent tags incorrectly
> receive the modified values instead of the original range.
> 
> Fix by creating per-iteration local copies initialized from the original parameters,
> ensuring each tag processes the intended flush range.
> 
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Ping


[Li,Rongqing] 


> ---
>  drivers/iommu/intel/cache.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c index
> fdc8881..9253025 100644
> --- a/drivers/iommu/intel/cache.c
> +++ b/drivers/iommu/intel/cache.c
> @@ -437,6 +437,9 @@ void cache_tag_flush_range(struct dmar_domain
> *domain, unsigned long start,
> 
>  	spin_lock_irqsave(&domain->cache_lock, flags);
>  	list_for_each_entry(tag, &domain->cache_tags, node) {
> +		unsigned long flush_addr = addr;
> +		unsigned long flush_mask = mask;
> +
>  		if (iommu && iommu != tag->iommu)
>  			qi_batch_flush_descs(iommu, domain->qi_batch);
>  		iommu = tag->iommu;
> @@ -444,7 +447,7 @@ void cache_tag_flush_range(struct dmar_domain
> *domain, unsigned long start,
>  		switch (tag->type) {
>  		case CACHE_TAG_IOTLB:
>  		case CACHE_TAG_NESTING_IOTLB:
> -			cache_tag_flush_iotlb(domain, tag, addr, mask, ih);
> +			cache_tag_flush_iotlb(domain, tag, flush_addr, flush_mask, ih);
>  			break;
>  		case CACHE_TAG_NESTING_DEVTLB:
>  			/*
> @@ -454,15 +457,15 @@ void cache_tag_flush_range(struct dmar_domain
> *domain, unsigned long start,
>  			 * affected by a change in S2. So just flush the entire
>  			 * device cache.
>  			 */
> -			addr = 0;
> -			mask = MAX_AGAW_PFN_WIDTH;
> +			flush_addr = 0;
> +			flush_mask = MAX_AGAW_PFN_WIDTH;
>  			fallthrough;
>  		case CACHE_TAG_DEVTLB:
> -			cache_tag_flush_devtlb_psi(domain, tag, addr, mask);
> +			cache_tag_flush_devtlb_psi(domain, tag, flush_addr, flush_mask);
>  			break;
>  		}
> 
> -		trace_cache_tag_flush_range(tag, start, end, addr, mask);
> +		trace_cache_tag_flush_range(tag, start, end, flush_addr, flush_mask);
>  	}
>  	qi_batch_flush_descs(iommu, domain->qi_batch);
>  	spin_unlock_irqrestore(&domain->cache_lock, flags);
> --
> 2.9.4