linux-kernel - [PATCH V2] iommu: sprd: fix a dma buffer leak issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230306052613.411400-1-chunyan.zhang@unisoc.com>
Date:   Mon, 6 Mar 2023 13:26:13 +0800
From:   Chunyan Zhang <chunyan.zhang@...soc.com>
To:     Joerg Roedel <joro@...tes.org>, Will Deacon <will@...nel.org>,
        "Robin Murphy" <robin.murphy@....com>
CC:     <iommu@...ts.linux.dev>,
        Baolin Wang <baolin.wang@...ux.alibaba.com>,
        Orson Zhai <orsonzhai@...il.com>,
        Chunyan Zhang <zhang.lyra@...il.com>,
        Chunyan Zhang <chunyan.zhang@...soc.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH V2] iommu: sprd: fix a dma buffer leak issue

The DMA buffer used to store the address mpping table is alloced when
attaching device to a domain, and had been released in .detach_dev()
callback which will never be called since this driver supports default
domain, that will cause memory leak.

Move the dma buffer free before freeing sprd iommu domain to fix
this issue.

Signed-off-by: Chunyan Zhang <chunyan.zhang@...soc.com>
---
V2: Modified commit message
---
 drivers/iommu/sprd-iommu.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/iommu/sprd-iommu.c b/drivers/iommu/sprd-iommu.c
index ae94d74b73f4..4de2e79d2226 100644
--- a/drivers/iommu/sprd-iommu.c
+++ b/drivers/iommu/sprd-iommu.c
@@ -154,6 +154,17 @@ static struct iommu_domain *sprd_iommu_domain_alloc(unsigned int domain_type)
 static void sprd_iommu_domain_free(struct iommu_domain *domain)
 {
 	struct sprd_iommu_domain *dom = to_sprd_domain(domain);
+	size_t pgt_size = sprd_iommu_pgt_size(domain);
+	struct sprd_iommu_device *sdev = dom->sdev;
+
+	/*
+	 * If the domain has been attached to a device already,
+	 * free the dma buffer first.
+	 */
+	if (sdev) {
+		dma_free_coherent(sdev->dev, pgt_size, dom->pgt_va, dom->pgt_pa);
+		dom->sdev = NULL;
+	}
 
 	kfree(dom);
 }
-- 
2.25.1