Commit 6129b59f authored by Nicolin Chen's avatar Nicolin Chen Committed by Jason Gunthorpe
Browse files

iommufd: Use iommufd_access_change_ioas in iommufd_access_destroy_object 

Update iommufd_access_destroy_object() to call the new
iommufd_access_change_ioas() helper.

It is impossible to legitimately race iommufd_access_destroy_object() with
iommufd_access_change_ioas() as iommufd_access_destroy_object() is only
called once the refcount reache zero, so any concurrent
iommufd_access_change_ioas() is already UAFing the memory.

Link: https://lore.kernel.org/r/f9fbeca2cde7f8515da18d689b3e02a6a40a5e14.1690523699.git.nicolinc@nvidia.com


Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Signed-off-by: default avatarNicolin Chen <nicolinc@nvidia.com>
Reviewed-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 9227da78

drivers/iommu/iommufd/device.c

+4 −6
Original line number Diff line number Diff line
@@ -753,12 +753,10 @@ void iommufd_access_destroy_object(struct iommufd_object *obj) 
	struct iommufd_access *access =

		container_of(obj, struct iommufd_access, obj);



	if (access->ioas) {

		iopt_remove_access(&access->ioas->iopt, access,

				   access->iopt_access_list_id);

		refcount_dec(&access->ioas->obj.users);

		access->ioas = NULL;

	}

	mutex_lock(&access->ioas_lock);

	if (access->ioas)

		WARN_ON(iommufd_access_change_ioas(access, NULL));

	mutex_unlock(&access->ioas_lock);

	iommufd_ctx_put(access->ictx);

}