* Re: [PATCH rc 1/2] iommu: Do not call drivers for empty gathers
[not found] <1-v1-13a02eb0e031+a5-iommu_gather_jgg@nvidia.com>
@ 2026-03-31 17:12 ` Jon Hunter
2026-03-31 19:58 ` Jason Gunthorpe
0 siblings, 1 reply; 2+ messages in thread
From: Jon Hunter @ 2026-03-31 17:12 UTC (permalink / raw)
To: Jason Gunthorpe, iommu, Joerg Roedel, Robin Murphy, Will Deacon
Cc: Alejandro Jimenez, Janusz Krzysztofik, Joerg Roedel, Kevin Tian,
Pasha Tatashin, patches, Samiullah Khawaja, stable,
linux-tegra@vger.kernel.org
Hi Jason,
On 02/03/2026 22:22, Jason Gunthorpe wrote:
> An empty gather is coded with start=U64_MAX, end=0 and several drivers go
> on to convert that to a size with:
>
> end - start + 1
>
> Which gives 2 for an empty gather. This then causes Weird Stuff to
> happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
> but maybe not.
>
> Prevent drivers from being called right in iommu_iotlb_sync().
>
> Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
> on these empty gathers.
>
> Further, there are several callers that can trigger empty gathers,
> especially in unusual conditions. For example iommu_map_nosync() will call
> a 0 size unmap on some error paths. Also in VFIO, iommupt and other
> places.
>
> Cc: stable@vger.kernel.org
> Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
> include/linux/iommu.h | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/iommu.h b/include/linux/iommu.h
> index 54b8b48c762e88..555597b54083cd 100644
> --- a/include/linux/iommu.h
> +++ b/include/linux/iommu.h
> @@ -980,7 +980,8 @@ static inline void iommu_flush_iotlb_all(struct iommu_domain *domain)
> static inline void iommu_iotlb_sync(struct iommu_domain *domain,
> struct iommu_iotlb_gather *iotlb_gather)
> {
> - if (domain->ops->iotlb_sync)
> + if (domain->ops->iotlb_sync &&
> + likely(iotlb_gather->start < iotlb_gather->end))
> domain->ops->iotlb_sync(domain, iotlb_gather);
>
> iommu_iotlb_gather_init(iotlb_gather);
I noticed that a couple of our Tegra boards are no longer booting -next
and bisect pointed to this commit. Reverting this does fix it.
This is impacting our Tegra186 (using nvidia,tegra186-smmu compatible
string) and Tegra194 (using nvidia,tegra194-smmu compatible string)
boards. There is no specific crash I see, but the boards just appear to
hang on boot. If you have any thoughts or things to try let me know.
Thanks!
Jon
--
nvpublic
^ permalink raw reply [flat|nested] 2+ messages in thread