Messages in this thread | | | Subject | Re: [PATCH] iommu/ipmmu-vmsa: Fix crash on early domain free | From | Robin Murphy <> | Date | Wed, 7 Nov 2018 13:22:52 +0000 |
| |
On 2018-11-07 1:18 pm, Geert Uytterhoeven wrote: > If iommu_ops.add_device() fails, iommu_ops.domain_free() is still > called, leading to a crash, as the domain was only partially > initialized: > > ipmmu-vmsa e67b0000.mmu: Cannot accommodate DMA translation for IOMMU page tables > sata_rcar ee300000.sata: Unable to initialize IPMMU context > iommu: Failed to add device ee300000.sata to group 0: -22 > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 > ... > Call trace: > ipmmu_domain_free+0x1c/0xa0 > iommu_group_release+0x48/0x68 > kobject_put+0x74/0xe8 > kobject_del.part.0+0x3c/0x50 > kobject_put+0x60/0xe8 > iommu_group_get_for_dev+0xa8/0x1f0 > ipmmu_add_device+0x1c/0x40 > of_iommu_configure+0x118/0x190 > > Fix this by checking if the domain's context already exists, before > trying to destroy it.
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> > --- > drivers/iommu/ipmmu-vmsa.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c > index c4114b92652eb0c9..a8b2c649c1d1f1b9 100644 > --- a/drivers/iommu/ipmmu-vmsa.c > +++ b/drivers/iommu/ipmmu-vmsa.c > @@ -498,6 +498,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain) > > static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) > { > + if (!domain->mmu) > + return; > + > /* > * Disable the context. Flush the TLB as required when modifying the > * context registers. >
| |