linux-kernel - [PATCH 6.6.y] iommu/amd: Fixes refcount bug in iommu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250306051822.4267-1-sidchintamaneni@gmail.com>
Date: Thu,  6 Mar 2025 05:18:22 +0000
From: Siddharth Chintamaneni <sidchintamaneni@...il.com>
To: stable@...r.kernel.org
Cc: joro@...tes.org,
	suravee.suthikulpanit@....com,
	will@...nel.org,
	robin.murphy@....com,
	iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	wei.huang2@....com,
	apais@...rosoft.com,
	Siddharth Chintamaneni <sidchintamaneni@...il.com>
Subject: [PATCH 6.6.y] iommu/amd: Fixes refcount bug in iommu_v2 driver

This fix addresses a refcount bug where the reference count was not
properly decremented due to the mmput function not being called when
mmu_notifier_register fails.

Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@...il.com>
---
 drivers/iommu/amd/iommu_v2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/amd/iommu_v2.c b/drivers/iommu/amd/iommu_v2.c
index 57c2fb1146e2..bce21e266d64 100644
--- a/drivers/iommu/amd/iommu_v2.c
+++ b/drivers/iommu/amd/iommu_v2.c
@@ -645,7 +645,7 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, u32 pasid,
 
 	ret = mmu_notifier_register(&pasid_state->mn, mm);
 	if (ret)
-		goto out_free;
+		goto out_mmput;
 
 	ret = set_pasid_state(dev_state, pasid_state, pasid);
 	if (ret)
@@ -673,6 +673,8 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, u32 pasid,
 
 out_unregister:
 	mmu_notifier_unregister(&pasid_state->mn, mm);
+
+out_mmput:
 	mmput(mm);
 
 out_free:
-- 
2.43.0