Commit 322d889a authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Joerg Roedel
Browse files

iommu/amd: Remove amd_iommu_domain_update() from page table freeing 



It is a serious bug if the domain is still mapped to any DTEs when it is
freed as we immediately start freeing page table memory, so any remaining
HW touch will UAF.

If it is not mapped then dev_list is empty and amd_iommu_domain_update()
does nothing.

Remove it and add a WARN_ON() to catch this class of bug.

Reviewed-by: default avatarVasant Hegde <vasant.hegde@amd.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/4-v2-831cdc4d00f3+1a315-amd_iopgtbl_jgg@nvidia.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 7a41dcb5

drivers/iommu/amd/io_pgtable.c

+0 −3
Original line number Diff line number Diff line
@@ -577,9 +577,6 @@ static void v1_free_pgtable(struct io_pgtable *iop) 


	/* Update data structure */

	amd_iommu_domain_clr_pt_root(dom);



	/* Make changes visible to IOMMUs */

	amd_iommu_domain_update(dom);

}



static struct io_pgtable *v1_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie)

drivers/iommu/amd/iommu.c

+2 −0
Original line number Diff line number Diff line
@@ -2255,6 +2255,8 @@ void protection_domain_free(struct protection_domain *domain) 
	if (!domain)

		return;



	WARN_ON(!list_empty(&domain->dev_list));



	if (domain->iop.pgtbl_cfg.tlb)

		free_io_pgtable_ops(&domain->iop.iop.ops);