From: Jason Gunthorpe <jgg@ziepe.ca>
To: Sina Hassani <sina@openai.com>
Cc: kevin.tian@intel.com, joro@8bytes.org, will@kernel.org,
robin.murphy@arm.com, iommu@lists.linux.dev,
linux-kernel@vger.kernel.org, Aaron Wisner <awiz@openai.com>,
stable@vger.kernel.org
Subject: Re: [PATCH v2] Fixes a race in iopt_unmap_iova_range
Date: Mon, 6 Apr 2026 22:27:26 -0300 [thread overview]
Message-ID: <20260407012726.GN2551565@ziepe.ca> (raw)
In-Reply-To: <CAAJpGJQXnMjhC4C7Z6bAQJN5y48fsbiwPd3YF5vft+1MBNFLVQ@mail.gmail.com>
On Mon, Apr 06, 2026 at 06:17:24PM -0700, Sina Hassani wrote:
> On Mon, Apr 6, 2026 at 6:12 PM Jason Gunthorpe <jgg@ziepe.ca> wrote:
> >
> > On Mon, Apr 06, 2026 at 04:07:01PM -0700, Sina Hassani wrote:
> >
> > > io_pagetable *iopt, unsigned long start,
> > > unmapped_bytes += area_last - area_first + 1;
> > >
> > > down_write(&iopt->iova_rwsem);
> > > +
> > > + /* Do not reconsider things already unmapped in case of
> > > + * concurrent allocation */
> > > + start = area_last + 1;
> >
> > area_last can be ULONG_MAX so this literally overflows to 0. It is why
> > I formed the suggestion I gave as I did
> >
> Yes, in which case the if (start < area_last) that follows will catch
> it. Are you suggesting I compare against ULONG_MAX instead?
iommufd does not have any overflows to 0 and rely on it tricks like
this. You should just compare to the existing iteration last
Jason
next prev parent reply other threads:[~2026-04-07 1:27 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-06 23:07 [PATCH v2] Fixes a race in iopt_unmap_iova_range Sina Hassani
2026-04-07 1:12 ` Jason Gunthorpe
2026-04-07 1:17 ` Sina Hassani
2026-04-07 1:27 ` Jason Gunthorpe [this message]
2026-04-07 1:40 ` Sina Hassani
2026-04-07 22:03 ` Sina Hassani
2026-04-09 15:15 ` Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260407012726.GN2551565@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=awiz@openai.com \
--cc=iommu@lists.linux.dev \
--cc=joro@8bytes.org \
--cc=kevin.tian@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=robin.murphy@arm.com \
--cc=sina@openai.com \
--cc=stable@vger.kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox