linux-kernel - [PATCH] iommu/vt-d: Do not BUG_ON in intel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon,  4 Aug 2014 13:23:06 +0200
From:	Joerg Roedel <joro@...tes.org>
To:	iommu@...ts.linux-foundation.org
Cc:	linux-kernel@...r.kernel.org, joro@...tes.org,
	Joerg Roedel <jroedel@...e.de>,
	Jiang Liu <jiang.liu@...ux.intel.com>,
	David Woodhouse <dwmw2@...radead.org>
Subject: [PATCH] iommu/vt-d: Do not BUG_ON in intel_unmap if no domain

From: Joerg Roedel <jroedel@...e.de>

This BUG_ON is easy to trigger with device-hotplug (e.g.
SR-IOV). The device_notifier function in the Intel IOMMU
driver listens to the BUS_NOTIFY_DEL_DEVICE event and frees
the domain for the device if it is reveived.

But this event is triggered before the device driver is
unbound from the device. When the driver core actually
removes the device the driver may release pending DMA
resources, which ends up in intel_unmap and triggers the
BUG_ON.

Not listening to BUS_NOTIFY_DEL_DEVICE would cause resource
leakage with devices that have never been assigned to any
driver, so fix this issue by just making unmap a nop when
the domain is already released.

Cc: Jiang Liu <jiang.liu@...ux.intel.com>
Cc: David Woodhouse <dwmw2@...radead.org>
Signed-off-by: Joerg Roedel <jroedel@...e.de>
---
 drivers/iommu/intel-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index d1f5caa..7d689d7 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3196,7 +3196,8 @@ static void intel_unmap(struct device *dev, dma_addr_t dev_addr)
 		return;

 	domain = find_domain(dev);
-	BUG_ON(!domain);
+	if (!domain)
+		return;

 	iommu = domain_get_iommu(domain);

-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/