From: Pranjal Shrivastava <praan@google.com>
To: "Tian, Kevin" <kevin.tian@intel.com>
Cc: "iommu@lists.linux.dev" <iommu@lists.linux.dev>,
"linux-pci@vger.kernel.org" <linux-pci@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>,
Robin Murphy <robin.murphy@arm.com>,
Baolu Lu <baolu.lu@linux.intel.com>,
Jason Gunthorpe <jgg@nvidia.com>,
Bjorn Helgaas <bhelgaas@google.com>,
Samiullah Khawaja <skhawaja@google.com>
Subject: Re: [PATCH v7 3/5] iommu/arm-smmu-v3: Fix a UAF in the probe_device error path
Date: Wed, 3 Jun 2026 13:28:29 +0000 [thread overview]
Message-ID: <aiAr_YZqVwijXyQ5@google.com> (raw)
In-Reply-To: <DM6PR11MB369078B4E5BC3C6514A99AFE8C132@DM6PR11MB3690.namprd11.prod.outlook.com>
On Wed, Jun 03, 2026 at 07:31:38AM +0000, Tian, Kevin wrote:
> > From: Pranjal Shrivastava <praan@google.com>
> > Sent: Monday, June 1, 2026 10:37 PM
> >
> > Clear the iommu->priv to NULL while returning an error from probe_device.
> >
> > Fixes: a2be6218e649 ("iommu/arm-smmu-v3: Improve add_device() error
> > handling")
> > Signed-off-by: Pranjal Shrivastava <praan@google.com>
>
> probably add a note that UAF is theoretical at this point.
>
> iommu_init_device() calls dev_iommu_free() right after @probe_device()
> fails...
Ack. This is just to prevent a UAF against future refactors. I saw the
intel & amd iommu drivers doing it and felt this is missing from smmuv3
>
> Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Thanks,
Praan
next prev parent reply other threads:[~2026-06-03 13:28 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-01 14:36 [PATCH v7 0/5] iommu: Standardize ATS robustness and state tracking Pranjal Shrivastava
2026-06-01 14:36 ` [PATCH v7 1/5] PCI/ATS: Ensure pci_ats_supported() is PF-aware for VFs Pranjal Shrivastava
2026-06-03 7:25 ` Tian, Kevin
2026-06-01 14:36 ` [PATCH v7 2/5] PCI/ATS: Validate STU for VFs in pci_prepare_ats() Pranjal Shrivastava
2026-06-03 7:28 ` Tian, Kevin
2026-06-01 14:36 ` [PATCH v7 3/5] iommu/arm-smmu-v3: Fix a UAF in the probe_device error path Pranjal Shrivastava
2026-06-01 15:06 ` sashiko-bot
2026-06-03 7:31 ` Tian, Kevin
2026-06-03 13:28 ` Pranjal Shrivastava [this message]
2026-06-03 14:59 ` Jason Gunthorpe
2026-06-04 2:29 ` Baolu Lu
2026-06-04 5:22 ` Pranjal Shrivastava
2026-06-01 14:36 ` [PATCH v7 4/5] iommu/arm-smmu-v3: Standardize ATS enablement failure reporting Pranjal Shrivastava
2026-06-03 7:34 ` Tian, Kevin
2026-06-03 9:12 ` Pranjal Shrivastava
2026-06-03 10:12 ` Tian, Kevin
2026-06-01 14:36 ` [PATCH v7 5/5] iommu/vt-d: Fail probe on ATS configuration failure Pranjal Shrivastava
2026-06-01 15:30 ` sashiko-bot
2026-06-01 16:01 ` Pranjal Shrivastava
2026-06-03 5:41 ` Baolu Lu
2026-06-03 7:34 ` Tian, Kevin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aiAr_YZqVwijXyQ5@google.com \
--to=praan@google.com \
--cc=baolu.lu@linux.intel.com \
--cc=bhelgaas@google.com \
--cc=iommu@lists.linux.dev \
--cc=jgg@nvidia.com \
--cc=joro@8bytes.org \
--cc=kevin.tian@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=robin.murphy@arm.com \
--cc=skhawaja@google.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.