Re: [PATCH 1/4] iommufd: Do not add the same hwpt to the ioas->hwpt_list twice

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Feb 14, 2023 at 05:51:13AM +0000, Tian, Kevin wrote:
> > From: Jason Gunthorpe <jgg@nvidia.com>
> > Sent: Tuesday, February 14, 2023 2:03 AM
> > 
> > The hwpt is added to the hwpt_list only during its creation, it is never
> > added again. This hunk is some missed leftover from rework. Adding it
> > twice will corrupt the linked list in some cases.
> > 
> > It effects HWPT specific attachment, which is something the test suite
> > cannot cover until we can create a legitimate struct device with a
> > non-system iommu "driver" (ie we need the bus removed from the iommu
> > code)
> > 
> > Cc: stable@vger.kernel.org
> > Fixes: e8d57210035b ("iommufd: Add kAPI toward external drivers for
> > physical devices")
> > Reported-by: Kevin Tian <kevin.tian@intel.com>
> > Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> 
> for stable kernels this kind of fixes an issue in a dead code path
> where no uAPI for user to manually create hwpt or return the
> hwpt id of auto domain to userspace.
>
> from that angle do we still want a fix tag?

I always put fixes tags, no matter how minor.

The cc stable is the thoughtful one.

In this case though there is no way to formall access this API the
HWPT ID does exist and a hostile userspace can guess it to trigger a
kernel bug. So it should be fixed.

Jason