From 413ed6ba222996bbfd05abd673da870c3fd5ecd5 Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" Date: Sat, 7 Jun 2025 01:28:15 +0000 Subject: [PATCH] ANDROID: iommu/arm-smmu-v3-kvm: Fix accidental domain ID freeing in free() kvm_arm_smmu_domain_finalize() always sets a domain's smmu field, even if the function fails. If the function fails and the caller attempts to free the domain, the kvm_arm_smmu_domain_free() function will be called. The will domain's smmu field is not NULL, so the logic will call into the hypervisor to free the domain, and free the domain ID back to the IDA. However, it's possible that the domain was not even allocated to begin with in the hypervisor, or the domain ID was not allocated either, hence why kvm_arm_smmu_domain_finalize() failed in the first place. Change kvm_arm_smmu_domain_finalize() to only set the smmu field if it succeeded to allocate all resources required. That way, the free() callback has meaningful objects to free. Bug: 423086309 Change-Id: Ib22bbf15b2f3649fc42d7788a17b8e25b8bd2777 [isaacmanjarres: Resolve trivial merge conflicts from differences between 6.6 and 6.12.] Signed-off-by: Isaac J. Manjarres --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-kvm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-kvm.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-kvm.c index 6aa47c22f3e4..13a1b8c11e69 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-kvm.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-kvm.c @@ -158,15 +158,13 @@ static int kvm_arm_smmu_domain_finalize(struct kvm_arm_smmu_domain *kvm_smmu_dom if (kvm_smmu_domain->smmu) return 0; - kvm_smmu_domain->smmu = smmu; - if (kvm_smmu_domain->domain.type == IOMMU_DOMAIN_IDENTITY) { kvm_smmu_domain->id = KVM_IOMMU_DOMAIN_IDMAP_ID; /* * Identity domains doesn't use the DMA API, so no need to * set the domain aperture. */ - return 0; + goto out; } /* Default to stage-1. */ @@ -224,7 +222,9 @@ static int kvm_arm_smmu_domain_finalize(struct kvm_arm_smmu_domain *kvm_smmu_dom return ret; } - return 0; +out: + kvm_smmu_domain->smmu = smmu; + return ret; } static void kvm_arm_smmu_domain_free(struct iommu_domain *domain)