Re: [PATCH] iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Re: [PATCH] iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

[Baolu Lu]

On 4/22/26 11:35, Zhenzhong Duan wrote:
> Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
> fixed a NULL pointer dereference in an unlikely situation partly.
> 
> If dev_pasid is not found in the dev_pasids list, it remains NULL.
> However, the teardown operations are executed unconditionally, this lead
> to a NULL pointer dereference or refcount corruption.
> 
> If the domain was never attached to this IOMMU, info will be NULL, which
> would cause an immediate dereference when checking --info->refcnt.
> 
> Even if info is not NULL, decrementing the refcount without having removed
> a valid PASID might unbalance the count. This could lead to premature
> dropping of the refcount to 0, potentially causing a use-after-free for the
> remaining active devices sharing the domain.
> 
> Fix it by returning early if dev_pasid is NULL, before executing the
> teardown operations.
> 
> Issue found by AI review and suggested by Kevin Tian.
> https://sashiko.dev/#/patchset/20260421031347.1408890-1- 
> zhenzhong.duan%40intel.com
> 
> Fixes: 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
> Suggested-by: Kevin Tian<kevin.tian@intel.com>
> Signed-off-by: Zhenzhong Duan<zhenzhong.duan@intel.com>
> ---
>   drivers/iommu/intel/iommu.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)

Queued for v7.1-rc. Thanks!