Re: [PATCH topic/core-for-CI] iommu: Do not call drivers for empty gathers

[Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>]

On Thu, 2026-04-02 at 11:23 +0200, Janusz Krzysztofik wrote:
> From: Jason Gunthorpe <jgg@nvidia.com>
> 
> An empty gather is coded with start=U64_MAX, end=0 and several drivers go
> on to convert that to a size with:
> 
>  end - start + 1
> 
> Which gives 2 for an empty gather. This then causes Weird Stuff to
> happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
> but maybe not.
> 
> Prevent drivers from being called right in iommu_iotlb_sync().
> 
> Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
> on these empty gathers.
> 
> Further, there are several callers that can trigger empty gathers,
> especially in unusual conditions. For example iommu_map_nosync() will call
> a 0 size unmap on some error paths. Also in VFIO, iommupt and other
> places.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
> Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
> Reviewed-by: Robin Murphy <robin.murphy@arm.com>
> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
> (cherry picked from commit 90c5def10bea574b101b7a520c015ca81742183f)

That commit is already in mainline, no need to pull it into core-for-CI 
any longer.

Thanks,
Janusz


> Link: https://lore.kernel.org/all/1-v1-13a02eb0e031+a5-iommu_gather_jgg@nvidia.com
> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15478
> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> ---
>  include/linux/iommu.h | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/iommu.h b/include/linux/iommu.h
> index 54b8b48c762e8..555597b54083c 100644
> --- a/include/linux/iommu.h
> +++ b/include/linux/iommu.h
> @@ -980,7 +980,8 @@ static inline void iommu_flush_iotlb_all(struct iommu_domain *domain)
>  static inline void iommu_iotlb_sync(struct iommu_domain *domain,
>  				  struct iommu_iotlb_gather *iotlb_gather)
>  {
> -	if (domain->ops->iotlb_sync)
> +	if (domain->ops->iotlb_sync &&
> +	    likely(iotlb_gather->start < iotlb_gather->end))
>  		domain->ops->iotlb_sync(domain, iotlb_gather);
>  
>  	iommu_iotlb_gather_init(iotlb_gather);