[PATCH] iommu: Ensure .iotlb_sync is called correctly

[PATCH] iommu: Ensure .iotlb_sync is called correctly

[Robin Murphy]

Many drivers have no reason to use the iotlb_gather mechanism, but do
still depend on .iotlb_sync being called to properly complete an unmap.
Since the core code is now relying on the gather to detect when there
is legitimately something to sync, it should also take care of encoding
a successful unmap when the driver does not touch the gather itself.

Fixes: 90c5def10bea ("iommu: Do not call drivers for empty gathers")
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Closes: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
---
 drivers/iommu/iommu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 50718ab810a4..ee83850c7060 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -2717,6 +2717,12 @@ static size_t __iommu_unmap(struct iommu_domain *domain,
 
 		pr_debug("unmapped: iova 0x%lx size 0x%zx\n",
 			 iova, unmapped_page);
+		/*
+		 * If the driver itself isn't using the gather, make sure
+		 * it looks non-empty so iotlb_sync will still be called.
+		 */
+		if (iotlb_gather->start >= iotlb_gather->end)
+			iommu_iotlb_gather_add_range(iotlb_gather, iova, size);
 
 		iova += unmapped_page;
 		unmapped += unmapped_page;
-- 
2.39.2.101.g768bb238c484.dirty

Re: [PATCH] iommu: Ensure .iotlb_sync is called correctly

[Jason Gunthorpe]

On Wed, Apr 08, 2026 at 03:40:57PM +0100, Robin Murphy wrote:
> Many drivers have no reason to use the iotlb_gather mechanism, but do
> still depend on .iotlb_sync being called to properly complete an unmap.
> Since the core code is now relying on the gather to detect when there
> is legitimately something to sync, it should also take care of encoding
> a successful unmap when the driver does not touch the gather itself.
> 
> Fixes: 90c5def10bea ("iommu: Do not call drivers for empty gathers")
> Reported-by: Jon Hunter <jonathanh@nvidia.com>
> Closes: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com
> Signed-off-by: Robin Murphy <robin.murphy@arm.com>
> ---
>  drivers/iommu/iommu.c | 6 ++++++
>  1 file changed, 6 insertions(+)

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason

Re: [PATCH] iommu: Ensure .iotlb_sync is called correctly

[Jon Hunter]

On 08/04/2026 15:40, Robin Murphy wrote:
> Many drivers have no reason to use the iotlb_gather mechanism, but do
> still depend on .iotlb_sync being called to properly complete an unmap.
> Since the core code is now relying on the gather to detect when there
> is legitimately something to sync, it should also take care of encoding
> a successful unmap when the driver does not touch the gather itself.
> 
> Fixes: 90c5def10bea ("iommu: Do not call drivers for empty gathers")
> Reported-by: Jon Hunter <jonathanh@nvidia.com>
> Closes: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com
> Signed-off-by: Robin Murphy <robin.murphy@arm.com>
> ---
>   drivers/iommu/iommu.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index 50718ab810a4..ee83850c7060 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -2717,6 +2717,12 @@ static size_t __iommu_unmap(struct iommu_domain *domain,
>   
>   		pr_debug("unmapped: iova 0x%lx size 0x%zx\n",
>   			 iova, unmapped_page);
> +		/*
> +		 * If the driver itself isn't using the gather, make sure
> +		 * it looks non-empty so iotlb_sync will still be called.
> +		 */
> +		if (iotlb_gather->start >= iotlb_gather->end)
> +			iommu_iotlb_gather_add_range(iotlb_gather, iova, size);
>   
>   		iova += unmapped_page;
>   		unmapped += unmapped_page;


Tested-by: Jon Hunter <jonathanh@nvidia.com>

Thanks!
Jon

-- 
nvpublic

Re: [PATCH] iommu: Ensure .iotlb_sync is called correctly

[Russell King (Oracle)]

On Wed, Apr 08, 2026 at 06:28:55PM +0100, Jon Hunter wrote:
> 
> On 08/04/2026 15:40, Robin Murphy wrote:
> > Many drivers have no reason to use the iotlb_gather mechanism, but do
> > still depend on .iotlb_sync being called to properly complete an unmap.
> > Since the core code is now relying on the gather to detect when there
> > is legitimately something to sync, it should also take care of encoding
> > a successful unmap when the driver does not touch the gather itself.
> > 
> > Fixes: 90c5def10bea ("iommu: Do not call drivers for empty gathers")
> > Reported-by: Jon Hunter <jonathanh@nvidia.com>
> > Closes: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com
> > Signed-off-by: Robin Murphy <robin.murphy@arm.com>
> > ---
> >   drivers/iommu/iommu.c | 6 ++++++
> >   1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> > index 50718ab810a4..ee83850c7060 100644
> > --- a/drivers/iommu/iommu.c
> > +++ b/drivers/iommu/iommu.c
> > @@ -2717,6 +2717,12 @@ static size_t __iommu_unmap(struct iommu_domain *domain,
> >   		pr_debug("unmapped: iova 0x%lx size 0x%zx\n",
> >   			 iova, unmapped_page);
> > +		/*
> > +		 * If the driver itself isn't using the gather, make sure
> > +		 * it looks non-empty so iotlb_sync will still be called.
> > +		 */
> > +		if (iotlb_gather->start >= iotlb_gather->end)
> > +			iommu_iotlb_gather_add_range(iotlb_gather, iova, size);
> >   		iova += unmapped_page;
> >   		unmapped += unmapped_page;
> 
> 
> Tested-by: Jon Hunter <jonathanh@nvidia.com>

Tested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>

I think the commit message needs to spell out that the blamed commit
causes random memory corruption which leads to data corruption and
kernel oopses.

Thanks!

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!

Re: [PATCH] iommu: Ensure .iotlb_sync is called correctly

[Will Deacon]

On Wed, 08 Apr 2026 15:40:57 +0100, Robin Murphy wrote:
> Many drivers have no reason to use the iotlb_gather mechanism, but do
> still depend on .iotlb_sync being called to properly complete an unmap.
> Since the core code is now relying on the gather to detect when there
> is legitimately something to sync, it should also take care of encoding
> a successful unmap when the driver does not touch the gather itself.
> 
> 
> [...]

Applied to iommu (fixes), thanks!

[1/1] iommu: Ensure .iotlb_sync is called correctly
      https://git.kernel.org/iommu/c/7e0548525abd

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev