All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jacob Pan <jacob.jun.pan@linux.intel.com>
To: LKML <linux-kernel@vger.kernel.org>,
	iommu@lists.linux-foundation.org,
	"Lu Baolu" <baolu.lu@linux.intel.com>,
	Joerg Roedel <joro@8bytes.org>,
	David Woodhouse <dwmw2@infradead.org>
Cc: Raj Ashok <ashok.raj@intel.com>
Subject: [PATCH 2/3] iommu/vt-d: Fix mm reference leak
Date: Thu, 19 Mar 2020 21:32:30 -0700	[thread overview]
Message-ID: <1584678751-43169-3-git-send-email-jacob.jun.pan@linux.intel.com> (raw)
In-Reply-To: <1584678751-43169-1-git-send-email-jacob.jun.pan@linux.intel.com>

Move canonical address check before mmget_not_zero() to avoid mm
reference leak.

Fixes: 9d8c3af31607 ("iommu/vt-d: IOMMU Page Request needs to check if
address is canonical.")

Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
---
 drivers/iommu/intel-svm.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 1483f1845762..56253c59ca10 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -861,14 +861,15 @@ static irqreturn_t prq_event_thread(int irq, void *d)
 		 * any faults on kernel addresses. */
 		if (!svm->mm)
 			goto bad_req;
-		/* If the mm is already defunct, don't handle faults. */
-		if (!mmget_not_zero(svm->mm))
-			goto bad_req;
 
 		/* If address is not canonical, return invalid response */
 		if (!is_canonical_address(address))
 			goto bad_req;
 
+		/* If the mm is already defunct, don't handle faults. */
+		if (!mmget_not_zero(svm->mm))
+			goto bad_req;
+
 		down_read(&svm->mm->mmap_sem);
 		vma = find_extend_vma(svm->mm, address);
 		if (!vma || address < vma->vm_start)
-- 
2.7.4

_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu

WARNING: multiple messages have this Message-ID (diff)
From: Jacob Pan <jacob.jun.pan@linux.intel.com>
To: LKML <linux-kernel@vger.kernel.org>,
	iommu@lists.linux-foundation.org,
	"Lu Baolu" <baolu.lu@linux.intel.com>,
	Joerg Roedel <joro@8bytes.org>,
	David Woodhouse <dwmw2@infradead.org>
Cc: Raj Ashok <ashok.raj@intel.com>, "Yi Liu" <yi.l.liu@intel.com>,
	Jacob Pan <jacob.jun.pan@linux.intel.com>
Subject: [PATCH 2/3] iommu/vt-d: Fix mm reference leak
Date: Thu, 19 Mar 2020 21:32:30 -0700	[thread overview]
Message-ID: <1584678751-43169-3-git-send-email-jacob.jun.pan@linux.intel.com> (raw)
In-Reply-To: <1584678751-43169-1-git-send-email-jacob.jun.pan@linux.intel.com>

Move canonical address check before mmget_not_zero() to avoid mm
reference leak.

Fixes: 9d8c3af31607 ("iommu/vt-d: IOMMU Page Request needs to check if
address is canonical.")

Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
---
 drivers/iommu/intel-svm.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 1483f1845762..56253c59ca10 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -861,14 +861,15 @@ static irqreturn_t prq_event_thread(int irq, void *d)
 		 * any faults on kernel addresses. */
 		if (!svm->mm)
 			goto bad_req;
-		/* If the mm is already defunct, don't handle faults. */
-		if (!mmget_not_zero(svm->mm))
-			goto bad_req;
 
 		/* If address is not canonical, return invalid response */
 		if (!is_canonical_address(address))
 			goto bad_req;
 
+		/* If the mm is already defunct, don't handle faults. */
+		if (!mmget_not_zero(svm->mm))
+			goto bad_req;
+
 		down_read(&svm->mm->mmap_sem);
 		vma = find_extend_vma(svm->mm, address);
 		if (!vma || address < vma->vm_start)
-- 
2.7.4


  parent reply	other threads:[~2020-03-20  4:26 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-20  4:32 [PATCH 0/3] Misc bug fixes for VT-d SVM Jacob Pan
2020-03-20  4:32 ` Jacob Pan
2020-03-20  4:32 ` [PATCH 1/3] iommu/vt-d: Remove redundant IOTLB flush Jacob Pan
2020-03-20  4:32   ` Jacob Pan
2020-03-20 13:45   ` Lu Baolu
2020-03-20 13:45     ` Lu Baolu
2020-03-20 16:20     ` Jacob Pan
2020-03-20 16:20       ` Jacob Pan
2020-03-21  1:32       ` Lu Baolu
2020-03-21  1:32         ` Lu Baolu
2020-03-24 15:31         ` Jacob Pan
2020-03-24 15:31           ` Jacob Pan
2020-03-25  0:48           ` Lu Baolu
2020-03-25  0:48             ` Lu Baolu
2020-03-20  4:32 ` Jacob Pan [this message]
2020-03-20  4:32   ` [PATCH 2/3] iommu/vt-d: Fix mm reference leak Jacob Pan
2020-03-20 13:49   ` Lu Baolu
2020-03-20 13:49     ` Lu Baolu
2020-03-20  4:32 ` [PATCH 3/3] iommu/vt-d: Add build dependency on IOASID Jacob Pan
2020-03-20  4:32   ` Jacob Pan
2020-03-20 13:57   ` Lu Baolu
2020-03-20 13:57     ` Lu Baolu
2020-03-27 10:04 ` [PATCH 0/3] Misc bug fixes for VT-d SVM Joerg Roedel
2020-03-27 10:04   ` Joerg Roedel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1584678751-43169-3-git-send-email-jacob.jun.pan@linux.intel.com \
    --to=jacob.jun.pan@linux.intel.com \
    --cc=ashok.raj@intel.com \
    --cc=baolu.lu@linux.intel.com \
    --cc=dwmw2@infradead.org \
    --cc=iommu@lists.linux-foundation.org \
    --cc=joro@8bytes.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.