lkml.org 
[lkml]   [2020]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 128/166] iommu/vt-d: Fix mm reference leak
    Date
    From: Jacob Pan <jacob.jun.pan@linux.intel.com>

    [ Upstream commit 902baf61adf6b187f0a6b789e70d788ea71ff5bc ]

    Move canonical address check before mmget_not_zero() to avoid mm
    reference leak.

    Fixes: 9d8c3af31607 ("iommu/vt-d: IOMMU Page Request needs to check if address is canonical.")
    Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
    Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/iommu/intel-svm.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
    index d7f2a53589002..fc7d78876e021 100644
    --- a/drivers/iommu/intel-svm.c
    +++ b/drivers/iommu/intel-svm.c
    @@ -611,14 +611,15 @@ static irqreturn_t prq_event_thread(int irq, void *d)
    * any faults on kernel addresses. */
    if (!svm->mm)
    goto bad_req;
    - /* If the mm is already defunct, don't handle faults. */
    - if (!mmget_not_zero(svm->mm))
    - goto bad_req;

    /* If address is not canonical, return invalid response */
    if (!is_canonical_address(address))
    goto bad_req;

    + /* If the mm is already defunct, don't handle faults. */
    + if (!mmget_not_zero(svm->mm))
    + goto bad_req;
    +
    down_read(&svm->mm->mmap_sem);
    vma = find_extend_vma(svm->mm, address);
    if (!vma || address < vma->vm_start)
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-04-22 12:32    [W:4.045 / U:0.568 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site