linux-kernel - Re: [PATCH] iommu: check if group is NULL before remove device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 30 Jul 2021 15:18:07 +0200
From:   "Frank Wunderlich (linux)" <linux@...web.de>
To:     Joerg Roedel <joro@...tes.org>
Cc:     iommu@...ts.linux-foundation.org,
        Frank Wunderlich <frank-w@...lic-files.de>,
        Will Deacon <will@...nel.org>, linux-kernel@...r.kernel.org,
        yong.wu@...iatek.com
Subject: Re: [PATCH] iommu: check if group is NULL before remove device

Am 2021-07-15 09:20, schrieb Joerg Roedel:
> On Thu, Jul 15, 2021 at 09:11:50AM +0200, Frank Wunderlich wrote:
>> From: Frank Wunderlich <frank-w@...lic-files.de>
>> 
>> if probe is failing, iommu_group may be not initialized,
> 
> Sentences start with capital letters.
> 
> IOMMU patch subjects too, after the 'iommu:' prefix.
> 
>> so freeing it will result in NULL pointer access
> 
> Please describe in more detail how this NULL-ptr dereference is
> triggered.

in my case probe (mtk_iommu_probe_device called from 
__iommu_probe_device) is failing due to fwspec missing and then 
dev_iommu_free/iommu_fwspec_free is called, later 
iommu_group_remove_device with group=NULL

i think i've found problem:

iommu_probe_device:
     group = iommu_group_get(dev);
     if (!group) { //group is checked here for NULL but accessed later
         ret = -ENODEV;
         goto err_release; <<<
     }
err_release:<<<
     iommu_release_device(dev);

------------------------------------------------------------------------------
void iommu_release_device(struct device *dev)
{
...
     iommu_group_remove_device(dev);

------------------------------------------------------------------------------
void iommu_group_remove_device(struct device *dev)
{
     struct iommu_group *group = dev->iommu_group;
     struct group_device *tmp_device, *device = NULL;
...
     dev_info(dev, "Removing from iommu group %d\n", group->id); //crash 
as group is NULL and not checked