linux-kernel - Re: [PATCH] vhost-vdpa: free iommu domain after last use during cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACGkMEtSe3ho5D3Lsx2gf2xUSJq+fgWcb-zsE6Lw4jJgSuLVjA@mail.gmail.com>
Date:   Thu, 2 Mar 2023 15:04:15 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Gautam Dawar <gautam.dawar@....com>
Cc:     "Michael S. Tsirkin" <mst@...hat.com>,
        Stefano Garzarella <sgarzare@...hat.com>, kvm@...r.kernel.org,
        virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-net-drivers@....com,
        harpreet.anand@....com, tanuj.kamde@....com,
        "Longpeng (Mike, Cloud Infrastructure Service Product Dept.)" 
        <longpeng2@...wei.com>
Subject: Re: [PATCH] vhost-vdpa: free iommu domain after last use during cleanup

On Thu, Mar 2, 2023 at 12:32 AM Gautam Dawar <gautam.dawar@....com> wrote:
>
> Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
> `iommu_unmap(v->domain, map->start, map->size);`
> from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
> provide DMA config operations.
>
> However, the IOMMU domain referred to by `v->domain` is freed in
> vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
> vhost_vdpa_release() which results in NULL pointer de-reference.
> Accordingly, moving the call to vhost_vdpa_free_domain() in
> vhost_vdpa_cleanup() would makes sense. This will also help
> detaching the dma device in error handling of vhost_vdpa_alloc_domain().
>
> This issue was observed on terminating QEMU with SIGQUIT.
>
> Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
> Signed-off-by: Gautam Dawar <gautam.dawar@....com>

Acked-by: Jason Wang <jasowang@...hat.com>

Thanks

> ---
>  drivers/vhost/vdpa.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ec32f785dfde..b7657984dd8d 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v)
>
>  err_attach:
>         iommu_domain_free(v->domain);
> +       v->domain = NULL;
>         return ret;
>  }
>
> @@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v)
>                         vhost_vdpa_remove_as(v, asid);
>         }
>
> +       vhost_vdpa_free_domain(v);
>         vhost_dev_cleanup(&v->vdev);
>         kfree(v->vdev.vqs);
>  }
> @@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)
>         vhost_vdpa_clean_irq(v);
>         vhost_vdpa_reset(v);
>         vhost_dev_stop(&v->vdev);
> -       vhost_vdpa_free_domain(v);
>         vhost_vdpa_config_put(v);
>         vhost_vdpa_cleanup(v);
>         mutex_unlock(&d->mutex);
> --
> 2.30.1
>