> viommu_probe() marks the device DRIVER_OK before populating the event
> virtqueue and registering the IOMMU device in sysfs. viommu_fill_evtq()
> hands the device a set of device-writable buffers through
> virtqueue_add_inbuf(), so from that point on the device may write into
> them and into the rings.
>
> If either step fails, the error path deletes the virtqueues without
> resetting the device first. The event buffers are allocated with
> devm_kmalloc_array() and are released as probe unwinds, so the device can
> go on writing to memory that has been freed.
>
> Reset the device before deleting the virtqueues, the way viommu_remove()
> already does.
>
> Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver")
> Signed-off-by: Yuho Choi <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
