[PATCH 0/2] iommu/vt-d: Fix issues on probe error path

[PATCH 0/2] iommu/vt-d: Fix issues on probe error path

[Pranjal Shrivastava]

This series addresses two pre-existing issues in the Intel VT-d driver's
probe error path. These issues were identified by Sashiko during the
review of the ATS series [1].

The first patch fixes an RB-tree corruption that occurs when probing
non-ATS devices. The second patch fixes a UAF by ensuring the per-device
private data pointer is cleared before freeing memory on failure.

[1] https://sashiko.dev/#/patchset/20260525184347.4059549-1-praan@google.com?part=4

Thanks,
Praan

Pranjal Shrivastava (2):
  iommu/vt-d: Fix RB-tree corruption in probe error path
  iommu/vt-d: Fix Use-After-Free in probe error path

 drivers/iommu/intel/iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

-- 
2.54.0.823.g6e5bcc1fc9-goog

[PATCH 1/2] iommu/vt-d: Fix RB-tree corruption in probe error path

[Pranjal Shrivastava]

The info->node RB-tree member is zero-initialized via kzalloc. If
a device does not support ATS, the device_rbtree_insert() call is
skipped. If a subsequent probe step fails, the error path jumps to
device_rbtree_remove(), which misinterprets the zeroed node as
a tree root and corrupts the device RB-tree.

Fix this by explicitly initializing the RB-node as empty using
RB_CLEAR_NODE() during initialization and guarding the removal with
RB_EMPTY_NODE().

Fixes: 4f1492efb495 ("iommu/vt-d: Revert ATS timing change to fix boot failure")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel.org/
Suggested-by: Baolu Lu <baolu.lu@linux.intel.com>
Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
 drivers/iommu/intel/iommu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index c3d18cd77d2f..2702e9aa2241 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -157,7 +157,10 @@ static void device_rbtree_remove(struct device_domain_info *info)
 	unsigned long flags;
 
 	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
-	rb_erase(&info->node, &iommu->device_rbtree);
+	if (!RB_EMPTY_NODE(&info->node)) {
+		rb_erase(&info->node, &iommu->device_rbtree);
+		RB_CLEAR_NODE(&info->node);
+	}
 	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
 }
 
@@ -3254,6 +3257,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
 
 	info->dev = dev;
 	info->iommu = iommu;
+	RB_CLEAR_NODE(&info->node);
 	if (dev_is_pci(dev)) {
 		if (ecap_dev_iotlb_support(iommu->ecap) &&
 		    pci_ats_supported(pdev) &&
-- 
2.54.0.823.g6e5bcc1fc9-goog

[PATCH 2/2] iommu/vt-d: Fix Use-After-Free in probe error path

[Pranjal Shrivastava]

When intel_iommu_probe_device() fails after the info structure has
been linked to the device via dev_iommu_priv_set(), the error path
calls kfree(info) but does not clear the pointer in the device
structure.

This results in a Use-After-Free regression if the pointer is accessed
by a subsequent IOMMU core call or a re-probe.

Fix this by ensuring dev_iommu_priv_set(dev, NULL) is called before
freeing the info structure in the error path.

Fixes: 89436f4f5412 ("iommu/vt-d: Fix WARN_ON in iommu probe path")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel.org/
Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
 drivers/iommu/intel/iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 2702e9aa2241..6c718adf97ae 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -3320,6 +3320,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
 clear_rbtree:
 	device_rbtree_remove(info);
 free:
+	dev_iommu_priv_set(dev, NULL);
 	kfree(info);
 
 	return ERR_PTR(ret);
-- 
2.54.0.823.g6e5bcc1fc9-goog

Re: [PATCH 2/2] iommu/vt-d: Fix Use-After-Free in probe error path

[Baolu Lu]

On 5/29/2026 7:34 PM, Pranjal Shrivastava wrote:
> When intel_iommu_probe_device() fails after the info structure has
> been linked to the device via dev_iommu_priv_set(), the error path
> calls kfree(info) but does not clear the pointer in the device
> structure.
> 
> This results in a Use-After-Free regression if the pointer is accessed
> by a subsequent IOMMU core call or a re-probe.
> 
> Fix this by ensuring dev_iommu_priv_set(dev, NULL) is called before
> freeing the info structure in the error path.
> 
> Fixes: 89436f4f5412 ("iommu/vt-d: Fix WARN_ON in iommu probe path")

Fixes: eda1a94caf6b ("iommu: Mark dev_iommu_priv_set() with a lockdep")

> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel.org/
> Signed-off-by: Pranjal Shrivastava <praan@google.com>
> ---
>   drivers/iommu/intel/iommu.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
> index 2702e9aa2241..6c718adf97ae 100644
> --- a/drivers/iommu/intel/iommu.c
> +++ b/drivers/iommu/intel/iommu.c
> @@ -3320,6 +3320,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
>   clear_rbtree:
>   	device_rbtree_remove(info);
>   free:
> +	dev_iommu_priv_set(dev, NULL);
>   	kfree(info);
>   
>   	return ERR_PTR(ret);

Thanks,
baolu

Re: [PATCH 2/2] iommu/vt-d: Fix Use-After-Free in probe error path

[Pranjal Shrivastava]

On Sat, May 30, 2026 at 09:33:12PM +0800, Baolu Lu wrote:
> On 5/29/2026 7:34 PM, Pranjal Shrivastava wrote:
> > When intel_iommu_probe_device() fails after the info structure has
> > been linked to the device via dev_iommu_priv_set(), the error path
> > calls kfree(info) but does not clear the pointer in the device
> > structure.
> > 
> > This results in a Use-After-Free regression if the pointer is accessed
> > by a subsequent IOMMU core call or a re-probe.
> > 
> > Fix this by ensuring dev_iommu_priv_set(dev, NULL) is called before
> > freeing the info structure in the error path.
> > 
> > Fixes: 89436f4f5412 ("iommu/vt-d: Fix WARN_ON in iommu probe path")
> 
> Fixes: eda1a94caf6b ("iommu: Mark dev_iommu_priv_set() with a lockdep")

Ack. Sending a v2 with this.

Thanks,
Praan