| Message ID | 20230301163203.29883-1-gautam.dawar@amd.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | vhost-vdpa: free iommu domain after last use during cleanup | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
On Thu, Mar 2, 2023 at 12:32 AM Gautam Dawar <gautam.dawar@amd.com> wrote: > > Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling > `iommu_unmap(v->domain, map->start, map->size);` > from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't > provide DMA config operations. > > However, the IOMMU domain referred to by `v->domain` is freed in > vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in > vhost_vdpa_release() which results in NULL pointer de-reference. > Accordingly, moving the call to vhost_vdpa_free_domain() in > vhost_vdpa_cleanup() would makes sense. This will also help > detaching the dma device in error handling of vhost_vdpa_alloc_domain(). > > This issue was observed on terminating QEMU with SIGQUIT. > > Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") > Signed-off-by: Gautam Dawar <gautam.dawar@amd.com> Acked-by: Jason Wang <jasowang@redhat.com> Thanks > --- > drivers/vhost/vdpa.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index ec32f785dfde..b7657984dd8d 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v) > > err_attach: > iommu_domain_free(v->domain); > + v->domain = NULL; > return ret; > } > > @@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v) > vhost_vdpa_remove_as(v, asid); > } > > + vhost_vdpa_free_domain(v); > vhost_dev_cleanup(&v->vdev); > kfree(v->vdev.vqs); > } > @@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) > vhost_vdpa_clean_irq(v); > vhost_vdpa_reset(v); > vhost_dev_stop(&v->vdev); > - vhost_vdpa_free_domain(v); > vhost_vdpa_config_put(v); > vhost_vdpa_cleanup(v); > mutex_unlock(&d->mutex); > -- > 2.30.1 >
On Wed, Mar 01, 2023 at 10:02:01PM +0530, Gautam Dawar wrote: >Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling >`iommu_unmap(v->domain, map->start, map->size);` >from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't >provide DMA config operations. > >However, the IOMMU domain referred to by `v->domain` is freed in >vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in >vhost_vdpa_release() which results in NULL pointer de-reference. >Accordingly, moving the call to vhost_vdpa_free_domain() in >vhost_vdpa_cleanup() would makes sense. This will also help >detaching the dma device in error handling of vhost_vdpa_alloc_domain(). Yep, good cleanup! > >This issue was observed on terminating QEMU with SIGQUIT. > >Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") >Signed-off-by: Gautam Dawar <gautam.dawar@amd.com> >--- > drivers/vhost/vdpa.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index ec32f785dfde..b7657984dd8d 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v) err_attach: iommu_domain_free(v->domain); + v->domain = NULL; return ret; } @@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v) vhost_vdpa_remove_as(v, asid); } + vhost_vdpa_free_domain(v); vhost_dev_cleanup(&v->vdev); kfree(v->vdev.vqs); } @@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) vhost_vdpa_clean_irq(v); vhost_vdpa_reset(v); vhost_dev_stop(&v->vdev); - vhost_vdpa_free_domain(v); vhost_vdpa_config_put(v); vhost_vdpa_cleanup(v); mutex_unlock(&d->mutex);
Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling `iommu_unmap(v->domain, map->start, map->size);` from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't provide DMA config operations. However, the IOMMU domain referred to by `v->domain` is freed in vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in vhost_vdpa_release() which results in NULL pointer de-reference. Accordingly, moving the call to vhost_vdpa_free_domain() in vhost_vdpa_cleanup() would makes sense. This will also help detaching the dma device in error handling of vhost_vdpa_alloc_domain(). This issue was observed on terminating QEMU with SIGQUIT. Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") Signed-off-by: Gautam Dawar <gautam.dawar@amd.com> --- drivers/vhost/vdpa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)