• J
    iommu/vt-d: fix access after free issue in function free_dmar_iommu() · 5ced12af
    Jiang Liu 提交于
    Function free_dmar_iommu() may access domain->iommu_lock by
    	spin_unlock_irqrestore(&domain->iommu_lock, flags);
    after freeing corresponding domain structure.
    
    Sample stack dump:
    [    8.912818] =========================
    [    8.917072] [ BUG: held lock freed! ]
    [    8.921335] 3.13.0-rc1-gerry+ #12 Not tainted
    [    8.926375] -------------------------
    [    8.930629] swapper/0/1 is freeing memory ffff880c23b56040-ffff880c23b5613f, with a lock still held there!
    [    8.941675]  (&(&domain->iommu_lock)->rlock){......}, at: [<ffffffff81dc775c>] init_dmars+0x72c/0x95b
    [    8.952582] 1 lock held by swapper/0/1:
    [    8.957031]  #0:  (&(&domain->iommu_lock)->rlock){......}, at: [<ffffffff81dc775c>] init_dmars+0x72c/0x95b
    [    8.968487]
    [    8.968487] stack backtrace:
    [    8.973602] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.13.0-rc1-gerry+ #12
    [    8.981556] Hardware name: Intel Corporation LH Pass ........../SVRBD-ROW_T, BIOS SE5C600.86B.99.99.x059.091020121352 09/10/2012
    [    8.994742]  ffff880c23b56040 ffff88042dd33c98 ffffffff815617fd ffff88042dd38b28
    [    9.003566]  ffff88042dd33cd0 ffffffff810a977a ffff880c23b56040 0000000000000086
    [    9.012403]  ffff88102c4923c0 ffff88042ddb4800 ffffffff81b1e8c0 ffff88042dd33d28
    [    9.021240] Call Trace:
    [    9.024138]  [<ffffffff815617fd>] dump_stack+0x4d/0x66
    [    9.030057]  [<ffffffff810a977a>] debug_check_no_locks_freed+0x15a/0x160
    [    9.037723]  [<ffffffff811aa1c2>] kmem_cache_free+0x62/0x5b0
    [    9.044225]  [<ffffffff81465e27>] domain_exit+0x197/0x1c0
    [    9.050418]  [<ffffffff81dc7788>] init_dmars+0x758/0x95b
    [    9.056527]  [<ffffffff81dc7dfa>] intel_iommu_init+0x351/0x438
    [    9.063207]  [<ffffffff81d8a711>] ? iommu_setup+0x27d/0x27d
    [    9.069601]  [<ffffffff81d8a739>] pci_iommu_init+0x28/0x52
    [    9.075910]  [<ffffffff81000342>] do_one_initcall+0x122/0x180
    [    9.082509]  [<ffffffff81077738>] ? parse_args+0x1e8/0x320
    [    9.088815]  [<ffffffff81d850e8>] kernel_init_freeable+0x1e1/0x26c
    [    9.095895]  [<ffffffff81d84833>] ? do_early_param+0x88/0x88
    [    9.102396]  [<ffffffff8154f580>] ? rest_init+0xd0/0xd0
    [    9.108410]  [<ffffffff8154f58e>] kernel_init+0xe/0x130
    [    9.114423]  [<ffffffff81574a2c>] ret_from_fork+0x7c/0xb0
    [    9.120612]  [<ffffffff8154f580>] ? rest_init+0xd0/0xd0
    Signed-off-by: NJiang Liu <jiang.liu@linux.intel.com>
    Signed-off-by: NJoerg Roedel <joro@8bytes.org>
    5ced12af
intel-iommu.c 108.4 KB