Commit 79ea2feb authored by Zhenzhong Duan's avatar Zhenzhong Duan Committed by Joerg Roedel
Browse files

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption 

Commit 60f030f7 ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
fixed a NULL pointer dereference in an unlikely situation partly.

If dev_pasid is not found in the dev_pasids list, it remains NULL.
However, the teardown operations are executed unconditionally, this lead
to a NULL pointer dereference or refcount corruption.

If the domain was never attached to this IOMMU, info will be NULL, which
would cause an immediate dereference when checking --info->refcnt.

Even if info is not NULL, decrementing the refcount without having removed
a valid PASID might unbalance the count. This could lead to premature
dropping of the refcount to 0, potentially causing a use-after-free for the
remaining active devices sharing the domain.

Fix it by returning early if dev_pasid is NULL, before executing the
teardown operations.

Issue found by AI review and suggested by Kevin Tian.
https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com



Fixes: 60f030f7 ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
Cc: stable@vger.kernel.org
Suggested-by: default avatarKevin Tian <kevin.tian@intel.com>
Signed-off-by: default avatarZhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20260422033538.95000-1-zhenzhong.duan@intel.com


Signed-off-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: default avatarJoerg Roedel <joerg.roedel@amd.com>
parent a6dea58d

drivers/iommu/intel/iommu.c

+5 −4
Original line number Diff line number Diff line
@@ -3545,13 +3545,14 @@ void domain_remove_dev_pasid(struct iommu_domain *domain, 
	}

	spin_unlock_irqrestore(&dmar_domain->lock, flags);



	if (WARN_ON_ONCE(!dev_pasid))

		return;



	cache_tag_unassign_domain(dmar_domain, dev, pasid);

	domain_detach_iommu(dmar_domain, iommu);

	if (!WARN_ON_ONCE(!dev_pasid)) {

	intel_iommu_debugfs_remove_dev_pasid(dev_pasid);

	kfree(dev_pasid);

}

}



static int blocking_domain_set_dev_pasid(struct iommu_domain *domain,

					 struct device *dev, ioasid_t pasid,