1. 28 2月, 2022 3 次提交
  2. 14 2月, 2022 2 次提交
  3. 04 2月, 2022 1 次提交
  4. 31 1月, 2022 3 次提交
    • G
      iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() · 99e675d4
      Guoqing Jiang 提交于
      After commit e3beca48 ("irqdomain/treewide: Keep firmware node
      unconditionally allocated"). For tear down scenario, fn is only freed
      after fail to allocate ir_domain, though it also should be freed in case
      dmar_enable_qi returns error.
      
      Besides free fn, irq_domain and ir_msi_domain need to be removed as well
      if intel_setup_irq_remapping fails to enable queued invalidation.
      
      Improve the rewinding path by add out_free_ir_domain and out_free_fwnode
      lables per Baolu's suggestion.
      
      Fixes: e3beca48 ("irqdomain/treewide: Keep firmware node unconditionally allocated")
      Suggested-by: NLu Baolu <baolu.lu@linux.intel.com>
      Signed-off-by: NGuoqing Jiang <guoqing.jiang@linux.dev>
      Link: https://lore.kernel.org/r/20220119063640.16864-1-guoqing.jiang@linux.devSigned-off-by: NLu Baolu <baolu.lu@linux.intel.com>
      Link: https://lore.kernel.org/r/20220128031002.2219155-3-baolu.lu@linux.intel.comSigned-off-by: NJoerg Roedel <jroedel@suse.de>
      99e675d4
    • J
      iommu: Fix some W=1 warnings · 30209b93
      John Garry 提交于
      The code is mostly free of W=1 warning, so fix the following:
      
      drivers/iommu/iommu.c:996: warning: expecting prototype for iommu_group_for_each_dev(). Prototype was for __iommu_group_for_each_dev() instead
      drivers/iommu/iommu.c:3048: warning: Function parameter or member 'drvdata' not described in 'iommu_sva_bind_device'
      drivers/iommu/ioasid.c:354: warning: Function parameter or member 'ioasid' not described in 'ioasid_get'
      drivers/iommu/omap-iommu.c:1098: warning: expecting prototype for omap_iommu_suspend_prepare(). Prototype was for omap_iommu_prepare() instead
      Signed-off-by: NJohn Garry <john.garry@huawei.com>
      Reviewed-by: NRobin Murphy <robin.murphy@arm.com>
      Link: https://lore.kernel.org/r/1643366673-26803-1-git-send-email-john.garry@huawei.comSigned-off-by: NJoerg Roedel <jroedel@suse.de>
      30209b93
    • V
      iommu: Fix potential use-after-free during probe · b54240ad
      Vijayanand Jitta 提交于
      Kasan has reported the following use after free on dev->iommu.
      when a device probe fails and it is in process of freeing dev->iommu
      in dev_iommu_free function, a deferred_probe_work_func runs in parallel
      and tries to access dev->iommu->fwspec in of_iommu_configure path thus
      causing use after free.
      
      BUG: KASAN: use-after-free in of_iommu_configure+0xb4/0x4a4
      Read of size 8 at addr ffffff87a2f1acb8 by task kworker/u16:2/153
      
      Workqueue: events_unbound deferred_probe_work_func
      Call trace:
       dump_backtrace+0x0/0x33c
       show_stack+0x18/0x24
       dump_stack_lvl+0x16c/0x1e0
       print_address_description+0x84/0x39c
       __kasan_report+0x184/0x308
       kasan_report+0x50/0x78
       __asan_load8+0xc0/0xc4
       of_iommu_configure+0xb4/0x4a4
       of_dma_configure_id+0x2fc/0x4d4
       platform_dma_configure+0x40/0x5c
       really_probe+0x1b4/0xb74
       driver_probe_device+0x11c/0x228
       __device_attach_driver+0x14c/0x304
       bus_for_each_drv+0x124/0x1b0
       __device_attach+0x25c/0x334
       device_initial_probe+0x24/0x34
       bus_probe_device+0x78/0x134
       deferred_probe_work_func+0x130/0x1a8
       process_one_work+0x4c8/0x970
       worker_thread+0x5c8/0xaec
       kthread+0x1f8/0x220
       ret_from_fork+0x10/0x18
      
      Allocated by task 1:
       ____kasan_kmalloc+0xd4/0x114
       __kasan_kmalloc+0x10/0x1c
       kmem_cache_alloc_trace+0xe4/0x3d4
       __iommu_probe_device+0x90/0x394
       probe_iommu_group+0x70/0x9c
       bus_for_each_dev+0x11c/0x19c
       bus_iommu_probe+0xb8/0x7d4
       bus_set_iommu+0xcc/0x13c
       arm_smmu_bus_init+0x44/0x130 [arm_smmu]
       arm_smmu_device_probe+0xb88/0xc54 [arm_smmu]
       platform_drv_probe+0xe4/0x13c
       really_probe+0x2c8/0xb74
       driver_probe_device+0x11c/0x228
       device_driver_attach+0xf0/0x16c
       __driver_attach+0x80/0x320
       bus_for_each_dev+0x11c/0x19c
       driver_attach+0x38/0x48
       bus_add_driver+0x1dc/0x3a4
       driver_register+0x18c/0x244
       __platform_driver_register+0x88/0x9c
       init_module+0x64/0xff4 [arm_smmu]
       do_one_initcall+0x17c/0x2f0
       do_init_module+0xe8/0x378
       load_module+0x3f80/0x4a40
       __se_sys_finit_module+0x1a0/0x1e4
       __arm64_sys_finit_module+0x44/0x58
       el0_svc_common+0x100/0x264
       do_el0_svc+0x38/0xa4
       el0_svc+0x20/0x30
       el0_sync_handler+0x68/0xac
       el0_sync+0x160/0x180
      
      Freed by task 1:
       kasan_set_track+0x4c/0x84
       kasan_set_free_info+0x28/0x4c
       ____kasan_slab_free+0x120/0x15c
       __kasan_slab_free+0x18/0x28
       slab_free_freelist_hook+0x204/0x2fc
       kfree+0xfc/0x3a4
       __iommu_probe_device+0x284/0x394
       probe_iommu_group+0x70/0x9c
       bus_for_each_dev+0x11c/0x19c
       bus_iommu_probe+0xb8/0x7d4
       bus_set_iommu+0xcc/0x13c
       arm_smmu_bus_init+0x44/0x130 [arm_smmu]
       arm_smmu_device_probe+0xb88/0xc54 [arm_smmu]
       platform_drv_probe+0xe4/0x13c
       really_probe+0x2c8/0xb74
       driver_probe_device+0x11c/0x228
       device_driver_attach+0xf0/0x16c
       __driver_attach+0x80/0x320
       bus_for_each_dev+0x11c/0x19c
       driver_attach+0x38/0x48
       bus_add_driver+0x1dc/0x3a4
       driver_register+0x18c/0x244
       __platform_driver_register+0x88/0x9c
       init_module+0x64/0xff4 [arm_smmu]
       do_one_initcall+0x17c/0x2f0
       do_init_module+0xe8/0x378
       load_module+0x3f80/0x4a40
       __se_sys_finit_module+0x1a0/0x1e4
       __arm64_sys_finit_module+0x44/0x58
       el0_svc_common+0x100/0x264
       do_el0_svc+0x38/0xa4
       el0_svc+0x20/0x30
       el0_sync_handler+0x68/0xac
       el0_sync+0x160/0x180
      
      Fix this by setting dev->iommu to NULL first and
      then freeing dev_iommu structure in dev_iommu_free
      function.
      Suggested-by: NRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: NVijayanand Jitta <quic_vjitta@quicinc.com>
      Link: https://lore.kernel.org/r/1643613155-20215-1-git-send-email-quic_vjitta@quicinc.comSigned-off-by: NJoerg Roedel <jroedel@suse.de>
      b54240ad
  5. 15 1月, 2022 1 次提交
  6. 20 12月, 2021 10 次提交
  7. 17 12月, 2021 14 次提交
  8. 15 12月, 2021 1 次提交
  9. 14 12月, 2021 4 次提交
  10. 06 12月, 2021 1 次提交
新手
引导
客服 返回
顶部