From: Jason Gunthorpe <jgg@nvidia.com>
To: Nicolin Chen <nicolinc@nvidia.com>
Cc: will@kernel.org, thierry.reding@gmail.com, vdumpa@nvidia.com,
robin.murphy@arm.com, joro@8bytes.org, jonathanh@nvidia.com,
linux-tegra@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, iommu@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH rc 2/2] iommu/tegra241-cmdqv: Fix UAF due to re-entry of tegra241_cmdqv_remove()
Date: Mon, 7 Apr 2025 14:45:50 -0300 [thread overview]
Message-ID: <20250407174550.GC1722458@nvidia.com> (raw)
In-Reply-To: <b3cebee623b4c3fc7de0aa2abcb703b9342ba33d.1744014481.git.nicolinc@nvidia.com>
On Mon, Apr 07, 2025 at 01:35:00AM -0700, Nicolin Chen wrote:
> When falling back to standard SMMU CMDQ, impl_ops must be set to NULL, so
> tegra241_cmdqv_remove() will not be re-entered by arm_smmu_impl_remove(),
> which will trigger a UAF.
>
> Fixes: 483e0bd8883a ("iommu/tegra241-cmdqv: Do not allocate vcmdq until dma_set_mask_and_coherent")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
> ---
> drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 1 +
> 1 file changed, 1 insertion(+)
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Jason
next prev parent reply other threads:[~2025-04-07 18:52 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-07 8:34 [PATCH rc 0/2] iommu/tegra241-cmdqv: Two bug fixes in fallback routine Nicolin Chen
2025-04-07 8:34 ` [PATCH rc 1/2] iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() Nicolin Chen
2025-04-07 17:44 ` Jason Gunthorpe
2025-04-07 18:46 ` Nicolin Chen
2025-04-07 8:35 ` [PATCH rc 2/2] iommu/tegra241-cmdqv: Fix UAF due to re-entry of tegra241_cmdqv_remove() Nicolin Chen
2025-04-07 17:45 ` Jason Gunthorpe [this message]
2025-04-07 18:51 ` Nicolin Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250407174550.GC1722458@nvidia.com \
--to=jgg@nvidia.com \
--cc=iommu@lists.linux.dev \
--cc=jonathanh@nvidia.com \
--cc=joro@8bytes.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tegra@vger.kernel.org \
--cc=nicolinc@nvidia.com \
--cc=robin.murphy@arm.com \
--cc=thierry.reding@gmail.com \
--cc=vdumpa@nvidia.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.