iopt_map_dmabuf() stores the PAL map result in exp_phys before checking for errors and publishes the attachment after dropping resv. The attachment is already linked to the DMA-buf. An invalidation after the unlock can therefore pass a NULL attachment to dma_buf_pal_unmap_phys(). On map failure, the non-NULL error pointer also looks like a live mapping to iopt_dmabuf_revoked().
Keep the map result local until it succeeds. Publish the attachment and physical list together before dropping resv, leaving exp_phys NULL on failure. Signed-off-by: Karl Mehltretter <[email protected]> --- drivers/iommu/iommufd/pages.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 0b32c65af..9e9bc6a1c 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1491,6 +1491,7 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages, { struct dma_buf_mapping_match pal_match[] = { DMA_BUF_IMAPPING_PAL() }; struct dma_buf_attachment *attach; + struct dma_buf_phys_list *phys; int rc; attach = dma_buf_mapping_attach(dmabuf, pal_match, @@ -1513,16 +1514,16 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages, if (rc) goto err_detach; - pages->dmabuf.exp_phys = dma_buf_pal_map_phys(attach); - if (IS_ERR(pages->dmabuf.exp_phys)) { - rc = PTR_ERR(pages->dmabuf.exp_phys); + phys = dma_buf_pal_map_phys(attach); + if (IS_ERR(phys)) { + rc = PTR_ERR(phys); goto err_unpin; } - dma_resv_unlock(dmabuf->resv); - /* On success iopt_release_pages() will detach and put the dmabuf. */ pages->dmabuf.attach = attach; + pages->dmabuf.exp_phys = phys; + dma_resv_unlock(dmabuf->resv); return 0; err_unpin: -- 2.39.5 (Apple Git-154)
