Re: [PATCH 2/2] iommu/vt-d: Fix possible use-after-free of private domain

[Alex Williamson]

On Tue,  6 Aug 2019 08:14:09 +0800
Lu Baolu  wrote:

> Multiple devices might share a private domain. One real example
> is a pci bridge and all devices behind it. When remove a private
> domain, make sure that it has been detached from all devices to
> avoid use-after-free case.
> 
> Cc: Ashok Raj 
> Cc: Jacob Pan 
> Cc: Kevin Tian 
> Cc: Alex Williamson 
> Fixes: 942067f1b6b97 ("iommu/vt-d: Identify default domains replaced with 
> private")
> Signed-off-by: Lu Baolu 
> ---

Tested-by: Alex Williamson 

>  drivers/iommu/intel-iommu.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
> index 37259b7f95a7..12d094d08c0a 100644
> --- a/drivers/iommu/intel-iommu.c
> +++ b/drivers/iommu/intel-iommu.c
> @@ -4791,7 +4791,8 @@ static void __dmar_remove_one_dev_info(struct 
> device_domain_info *info)
>  
>   /* free the private domain */
>   if (domain->flags & DOMAIN_FLAG_LOSE_CHILDREN &&
> - !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY))
> + !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
> + list_empty(>devices))
>   domain_exit(info->domain);
>  
>   free_devinfo_mem(info);

___
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu

[PATCH 2/2] iommu/vt-d: Fix possible use-after-free of private domain

[Lu Baolu]

Multiple devices might share a private domain. One real example
is a pci bridge and all devices behind it. When remove a private
domain, make sure that it has been detached from all devices to
avoid use-after-free case.

Cc: Ashok Raj 
Cc: Jacob Pan 
Cc: Kevin Tian 
Cc: Alex Williamson 
Fixes: 942067f1b6b97 ("iommu/vt-d: Identify default domains replaced with 
private")
Signed-off-by: Lu Baolu 
---
 drivers/iommu/intel-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 37259b7f95a7..12d094d08c0a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4791,7 +4791,8 @@ static void __dmar_remove_one_dev_info(struct 
device_domain_info *info)
 
/* free the private domain */
if (domain->flags & DOMAIN_FLAG_LOSE_CHILDREN &&
-   !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY))
+   !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+   list_empty(>devices))
domain_exit(info->domain);
 
free_devinfo_mem(info);
-- 
2.17.1