linux-kernel - [PATCH] iommu/arm-smmu-v3: Fix an error handling path in arm_smmu_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <596b9a44410c67d04599cfd4d6825fa8253c8830.1671484609.git.christophe.jaillet@wanadoo.fr>
Date:   Mon, 19 Dec 2022 22:17:09 +0100
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>,
        Joerg Roedel <joro@...tes.org>,
        Eric Auger <eric.auger@...hat.com>,
        Jean-Philippe Brucker <jean-philippe@...aro.org>,
        Jonathan Cameron <Jonathan.Cameron@...wei.com>
Cc:     linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>,
        linux-arm-kernel@...ts.infradead.org, iommu@...ts.linux.dev
Subject: [PATCH] iommu/arm-smmu-v3: Fix an error handling path in arm_smmu_device_probe()

In the arm_smmu_device_probe() probe function, we have the following call
chain:
  arm_smmu_device_probe()
    --> arm_smmu_init_structures()
       --> arm_smmu_init_queues()
          --> iopf_queue_alloc()

This memory allocation has to be undone in the error handling path of the
probe,  as already done in the remove function.

While at it, also move a iommu_device_sysfs_remove() call to the newly
created error handling path so that error handling is all at the same
place.

Fixes: 395ad89d11fd ("iommu/arm-smmu-v3: Add stall support for platform devices")
Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index ab160198edd6..2051b1ed1ff6 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -3826,22 +3826,27 @@ static int arm_smmu_device_probe(struct platform_device *pdev)
 	/* Reset the device */
 	ret = arm_smmu_device_reset(smmu, bypass);
 	if (ret)
-		return ret;
+		goto err_free_queue;
 
 	/* And we're up. Go go go! */
 	ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL,
 				     "smmu3.%pa", &ioaddr);
 	if (ret)
-		return ret;
+		goto err_free_queue;
 
 	ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev);
 	if (ret) {
 		dev_err(dev, "Failed to register iommu\n");
-		iommu_device_sysfs_remove(&smmu->iommu);
-		return ret;
+		goto err_remove_sysfs;
 	}
 
 	return 0;
+
+err_remove_sysfs:
+	iommu_device_sysfs_remove(&smmu->iommu);
+err_free_queue:
+	iopf_queue_free(smmu->evtq.iopf);
+	return ret;
 }
 
 static int arm_smmu_device_remove(struct platform_device *pdev)
-- 
2.34.1