[PATCH] iommu: Clear the freelist after iommu_put_pages_list()

[PATCH] iommu: Clear the freelist after iommu_put_pages_list()

[Jason Gunthorpe]

The commit below reworked how iommu_put_pages_list() worked to not do
list_del() on every entry. This was done expecting all the callers to
already re-init the the list so doing a per-item deletion is not
efficient.

It was missed that fq_ring_free_locked() re-uses its list after calling
iomomu_put_pages_list() and so the leftover list reaches free'd struct
pages and will crash or WARN/BUG/etc.

Reinit the list to empty in fq_ring_free_locked() after calling
iommu_put_pages_list().

Audit to see if any other callers of iommu_put_pages_list() need the list
to be empty:

 - iommu_dma_free_fq_single() and iommu_dma_free_fq_percpu() immediately
   frees the memory

 - iommu_v1_map_pages(), v1_free_pgtable(), domain_exit(),
   riscv_iommu_map_pages() uses a stack variable which goes out of scope

 - intel_iommu_tlb_sync() uses a gather in a iotlb_sync() callback, the
   caller re-inits the gather

Fixes: 13f43d7cf3e0 ("iommu/pages: Formalize the freelist API")
Reported-by: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com>
Closes: https://lore.kernel.org/r/SJ1PR11MB61292CE72D7BE06B8810021CB997A@SJ1PR11MB6129.namprd11.prod.outlook.com
Tested-by: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/iommu/dma-iommu.c   | 2 ++
 drivers/iommu/iommu-pages.c | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 0af1ab36283cba..7d2b51a890c75a 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -154,6 +154,8 @@ static void fq_ring_free_locked(struct iommu_dma_cookie *cookie, struct iova_fq
 			       fq->entries[idx].iova_pfn,
 			       fq->entries[idx].pages);
 
+		fq->entries[idx].freelist =
+			IOMMU_PAGES_LIST_INIT(fq->entries[idx].freelist);
 		fq->head = (fq->head + 1) & fq->mod_mask;
 	}
 }
diff --git a/drivers/iommu/iommu-pages.c b/drivers/iommu/iommu-pages.c
index 4cc77fddfeeb47..238c09e5166b4d 100644
--- a/drivers/iommu/iommu-pages.c
+++ b/drivers/iommu/iommu-pages.c
@@ -105,7 +105,9 @@ EXPORT_SYMBOL_GPL(iommu_free_pages);
  * iommu_put_pages_list - free a list of pages.
  * @list: The list of pages to be freed
  *
- * Frees a list of pages allocated by iommu_alloc_pages_node_sz().
+ * Frees a list of pages allocated by iommu_alloc_pages_node_sz(). On return the
+ * passed list is invalid, the caller must use IOMMU_PAGES_LIST_INIT to reinit
+ * the list if it expects to use it again.
  */
 void iommu_put_pages_list(struct iommu_pages_list *list)
 {

base-commit: 53a79ce36c832fc4832a9c2c730a9b0f2a07189e
-- 
2.43.0

Re: [PATCH] iommu: Clear the freelist after iommu_put_pages_list()

[Joerg Roedel]

On Wed, May 14, 2025 at 09:48:55AM -0300, Jason Gunthorpe wrote:
>  drivers/iommu/dma-iommu.c   | 2 ++
>  drivers/iommu/iommu-pages.c | 4 +++-
>  2 files changed, 5 insertions(+), 1 deletion(-)

Applied, thanks.