linux-kernel - Re: [PATCH] iommu/intel-iommu: fix memory leak in intel_iommu_put_resv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ce818491-4b9c-a5d8-7ad6-707aa25445ed@redhat.com>
Date:   Wed, 16 Jan 2019 21:43:40 +0100
From:   Auger Eric <eric.auger@...hat.com>
To:     Gerald Schaefer <gerald.schaefer@...ibm.com>,
        Joerg Roedel <jroedel@...e.de>
Cc:     David Woodhouse <dwmw2@...radead.org>,
        Robin Murphy <robin.murphy@....com>,
        linux-kernel@...r.kernel.org, iommu@...ts.linux-foundation.org,
        kvm@...r.kernel.org, Alex Williamson <alex.williamson@...hat.com>
Subject: Re: [PATCH] iommu/intel-iommu: fix memory leak in
 intel_iommu_put_resv_regions()

Hi Gerald,

On 1/16/19 8:11 PM, Gerald Schaefer wrote:
> Commit 9d3a4de4cb8d ("iommu: Disambiguate MSI region types") changed
> the reserved region type in intel_iommu_get_resv_regions() from
> IOMMU_RESV_RESERVED to IOMMU_RESV_MSI, but it forgot to also change
> the type in intel_iommu_put_resv_regions().
> 
> This leads to a memory leak, because now the check in
> intel_iommu_put_resv_regions() for IOMMU_RESV_RESERVED will never
> be true, and no allocated regions will be freed.
> 
> Fix this by changing the region type in intel_iommu_put_resv_regions()
> to IOMMU_RESV_MSI, matching the type of the allocated regions.
> 
> Fixes: 9d3a4de4cb8d ("iommu: Disambiguate MSI region types")
> Cc: <stable@...r.kernel.org> # v4.11+
> Signed-off-by: Gerald Schaefer <gerald.schaefer@...ibm.com>
Reviewed-by: Eric Auger <eric.auger@...hat.com>

Thanks

Eric

> ---
>  drivers/iommu/intel-iommu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
> index 048b5ab36a02..b83e0f2025bb 100644
> --- a/drivers/iommu/intel-iommu.c
> +++ b/drivers/iommu/intel-iommu.c
> @@ -5295,7 +5295,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
>  	struct iommu_resv_region *entry, *next;
>  
>  	list_for_each_entry_safe(entry, next, head, list) {
> -		if (entry->type == IOMMU_RESV_RESERVED)
> +		if (entry->type == IOMMU_RESV_MSI)
>  			kfree(entry);
>  	}
>  }
>