Commit b80fab28 authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

iommufd/selftest: Do not leak the hwpt if IOMMU_TEST_OP_MD_CHECK_MAP fails 

If the input validation fails it returned without freeing the hwpt
refcount causing a leak. This triggers a WARN_ON when closing the fd:

  WARNING: drivers/iommu/iommufd/main.c:369 at iommufd_fops_release+0x385/0x430, CPU#1: repro/724

Found by szykaller.

Fixes: e93d5945 ("iommufd: Change the selftest to use iommupt instead of xarray")
Link: https://patch.msgid.link/r/0-v1-c8ed57e24380+44ae-iommufd_selftest_hwpt_leak_jgg@nvidia.com


Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Reviewed-by: default avatarPasha Tatashin <pasha.tatashin@soleen.com>
Reported-by: default avatar"Lai, Yi" <yi1.lai@linux.intel.com>
Closes: https://lore.kernel.org/r/aTJGMaqwQK0ASj0G@ly-workstation


Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 5b244b07

drivers/iommu/iommufd/selftest.c

+4 −2
Original line number Diff line number Diff line
@@ -1215,8 +1215,10 @@ static int iommufd_test_md_check_pa(struct iommufd_ucmd *ucmd, 
	page_size = 1 << __ffs(mock->domain.pgsize_bitmap);

	if (iova % page_size || length % page_size ||

	    (uintptr_t)uptr % page_size ||

	    check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end))

		return -EINVAL;

	    check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end)) {

		rc = -EINVAL;

		goto out_put;

	}



	for (; length; length -= page_size) {

		struct page *pages[1];