Files
rockchip-kernel/include/linux
Liu Yi L 18abda7a2d iommu/vt-d: Fix general protection fault in aux_detach_device()
The aux-domain attach/detach are not tracked, some data structures might
be used after free. This causes general protection faults when multiple
subdevices are created and assigned to a same guest machine:

  | general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] SMP NOPTI
  | RIP: 0010:intel_iommu_aux_detach_device+0x12a/0x1f0
  | [...]
  | Call Trace:
  |  iommu_aux_detach_device+0x24/0x70
  |  vfio_mdev_detach_domain+0x3b/0x60
  |  ? vfio_mdev_set_domain+0x50/0x50
  |  iommu_group_for_each_dev+0x4f/0x80
  |  vfio_iommu_detach_group.isra.0+0x22/0x30
  |  vfio_iommu_type1_detach_group.cold+0x71/0x211
  |  ? find_exported_symbol_in_section+0x4a/0xd0
  |  ? each_symbol_section+0x28/0x50
  |  __vfio_group_unset_container+0x4d/0x150
  |  vfio_group_try_dissolve_container+0x25/0x30
  |  vfio_group_put_external_user+0x13/0x20
  |  kvm_vfio_group_put_external_user+0x27/0x40 [kvm]
  |  kvm_vfio_destroy+0x45/0xb0 [kvm]
  |  kvm_put_kvm+0x1bb/0x2e0 [kvm]
  |  kvm_vm_release+0x22/0x30 [kvm]
  |  __fput+0xcc/0x260
  |  ____fput+0xe/0x10
  |  task_work_run+0x8f/0xb0
  |  do_exit+0x358/0xaf0
  |  ? wake_up_state+0x10/0x20
  |  ? signal_wake_up_state+0x1a/0x30
  |  do_group_exit+0x47/0xb0
  |  __x64_sys_exit_group+0x18/0x20
  |  do_syscall_64+0x57/0x1d0
  |  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix the crash by tracking the subdevices when attaching and detaching
aux-domains.

Fixes: 67b8e02b5e ("iommu/vt-d: Aux-domain specific domain attach/detach")
Co-developed-by: Xin Zeng <xin.zeng@intel.com>
Signed-off-by: Xin Zeng <xin.zeng@intel.com>
Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/1609949037-25291-3-git-send-email-yi.l.liu@intel.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-01-07 14:35:14 +00:00
..
2020-12-09 19:26:02 -06:00
2020-12-02 09:46:55 -07:00
2020-11-06 08:08:37 -08:00
2020-09-21 15:00:40 -07:00
2020-12-02 09:46:55 -07:00
2020-12-19 11:18:38 -08:00
2020-10-16 17:21:51 +02:00
2020-12-14 16:24:19 +01:00
2020-12-11 14:02:14 -08:00
2020-12-02 22:00:22 -08:00
2020-12-10 12:42:59 -06:00
2020-11-16 16:31:41 +01:00
2020-11-16 15:20:01 +01:00
2020-11-16 08:14:30 -07:00
2020-12-02 22:10:35 -08:00
2020-11-23 14:16:55 +00:00
2020-12-08 14:14:48 +00:00
2020-09-16 08:54:53 -05:00
2020-11-24 16:47:48 +01:00
2020-12-15 16:19:31 +01:00
2020-12-15 16:19:31 +01:00
2020-09-04 09:25:20 -07:00
2020-09-23 18:02:49 -07:00
2020-12-07 10:29:57 +01:00
2020-09-04 12:46:07 +01:00
2020-12-04 12:23:25 +01:00
2020-09-24 19:49:36 -07:00
2020-12-15 15:11:08 -06:00
2020-08-31 12:52:33 -07:00
2020-12-16 13:08:18 -08:00
2020-10-18 09:27:10 -07:00
2020-12-03 11:20:52 +01:00
2020-12-15 12:13:39 -08:00
2020-12-07 17:12:49 -07:00
2020-11-06 10:05:18 -08:00
2020-12-10 16:17:15 +01:00
2020-12-15 12:13:37 -08:00
2020-11-24 16:47:49 +01:00
2020-12-10 10:45:36 +01:00
2020-09-26 22:55:05 -04:00
2020-12-19 11:18:38 -08:00
2020-10-30 21:57:04 +01:00
2020-11-16 15:20:01 +01:00
2020-12-04 16:54:35 +01:00
2020-11-09 18:39:36 +01:00
2020-09-10 14:03:31 -07:00
2020-12-15 12:13:41 -08:00
2020-10-05 13:21:49 +02:00