diff options
| author | Nicolin Chen <nicolinc@nvidia.com> | 2023-07-27 23:33:26 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2023-07-28 13:31:24 -0300 |
| commit | 6129b59fcdf374b5d82e1f4518884da13de38b1a (patch) | |
| tree | ca5b776d4d4cc09599730a79a07d751be4ca708d /drivers/iommu/iommufd | |
| parent | 9227da7816dd1a42e20d41e2244cb63c205477ca (diff) | |
iommufd: Use iommufd_access_change_ioas in iommufd_access_destroy_object
Update iommufd_access_destroy_object() to call the new
iommufd_access_change_ioas() helper.
It is impossible to legitimately race iommufd_access_destroy_object() with
iommufd_access_change_ioas() as iommufd_access_destroy_object() is only
called once the refcount reache zero, so any concurrent
iommufd_access_change_ioas() is already UAFing the memory.
Link: https://lore.kernel.org/r/f9fbeca2cde7f8515da18d689b3e02a6a40a5e14.1690523699.git.nicolinc@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/iommu/iommufd')
| -rw-r--r-- | drivers/iommu/iommufd/device.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c index e5c408415e95..c0b9cd97ec58 100644 --- a/drivers/iommu/iommufd/device.c +++ b/drivers/iommu/iommufd/device.c @@ -753,12 +753,10 @@ void iommufd_access_destroy_object(struct iommufd_object *obj) struct iommufd_access *access = container_of(obj, struct iommufd_access, obj); - if (access->ioas) { - iopt_remove_access(&access->ioas->iopt, access, - access->iopt_access_list_id); - refcount_dec(&access->ioas->obj.users); - access->ioas = NULL; - } + mutex_lock(&access->ioas_lock); + if (access->ioas) + WARN_ON(iommufd_access_change_ioas(access, NULL)); + mutex_unlock(&access->ioas_lock); iommufd_ctx_put(access->ictx); } |