netdev - Re: [PATCH] vhost-vdpa: free iommu domain after last use during cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 2 Mar 2023 09:33:14 +0100
From:   Stefano Garzarella <sgarzare@...hat.com>
To:     Gautam Dawar <gautam.dawar@....com>
Cc:     "Michael S. Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>, kvm@...r.kernel.org,
        virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-net-drivers@....com,
        harpreet.anand@....com, tanuj.kamde@....com
Subject: Re: [PATCH] vhost-vdpa: free iommu domain after last use during
 cleanup

On Wed, Mar 01, 2023 at 10:02:01PM +0530, Gautam Dawar wrote:
>Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
>`iommu_unmap(v->domain, map->start, map->size);`
>from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
>provide DMA config operations.
>
>However, the IOMMU domain referred to by `v->domain` is freed in
>vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
>vhost_vdpa_release() which results in NULL pointer de-reference.
>Accordingly, moving the call to vhost_vdpa_free_domain() in
>vhost_vdpa_cleanup() would makes sense. This will also help
>detaching the dma device in error handling of vhost_vdpa_alloc_domain().

Yep, good cleanup!

>
>This issue was observed on terminating QEMU with SIGQUIT.
>
>Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
>Signed-off-by: Gautam Dawar <gautam.dawar@....com>
>---
> drivers/vhost/vdpa.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Stefano Garzarella <sgarzare@...hat.com>