tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: iommu/arm-smmu-v3-kvm: Fix accidental domain ID freeing in free()

Browse Source 
kvm_arm_smmu_domain_finalize() always sets a domain's smmu field, even
if the function fails. If the function fails and the caller attempts
to free the domain, the kvm_arm_smmu_domain_free() function will be
called. The will domain's smmu field is not NULL, so the logic will
call into the hypervisor to free the domain, and free the domain
ID back to the IDA.

However, it's possible that the domain was not even allocated to begin
with in the hypervisor, or the domain ID was not allocated either,
hence why kvm_arm_smmu_domain_finalize() failed in the first place.

Change kvm_arm_smmu_domain_finalize() to only set the smmu field
if it succeeded to allocate all resources required. That way, the
free() callback has meaningful objects to free.

Bug: 423086309
Change-Id: Ib22bbf15b2f3649fc42d7788a17b8e25b8bd2777
[isaacmanjarres: Resolve trivial merge conflicts from differences
between 6.6 and 6.12.]
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
This commit is contained in:
Isaac J. Manjarres
2025-06-07 01:28:15 +00:00
committed by Treehugger Robot
parent f152c4b68d
commit 413ed6ba22
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-kvm.c
View File

@@ -158,15 +158,13 @@ static int kvm_arm_smmu_domain_finalize(struct kvm_arm_smmu_domain *kvm_smmu_dom
if (kvm_smmu_domain->smmu)
return 0;
kvm_smmu_domain->smmu = smmu;
if (kvm_smmu_domain->domain.type == IOMMU_DOMAIN_IDENTITY) {
kvm_smmu_domain->id = KVM_IOMMU_DOMAIN_IDMAP_ID;
/*
* Identity domains doesn't use the DMA API, so no need to
* set the domain aperture.
*/
return 0;
goto out;
}
/* Default to stage-1. */
@@ -224,7 +222,9 @@ static int kvm_arm_smmu_domain_finalize(struct kvm_arm_smmu_domain *kvm_smmu_dom
return ret;
}
return 0;
out:
kvm_smmu_domain->smmu = smmu;
return ret;
}
static void kvm_arm_smmu_domain_free(struct iommu_domain *domain)