Commit da99c80b authored by Gautam Dawar's avatar Gautam Dawar Committed by jiangdongxu
Browse files

vhost-vdpa: free iommu domain after last use during cleanup 

mainline inclusion
from mainline-v6.3-rc3
commit 5a522150
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I86ITO
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5a522150093a0eabae9470a70a37a6e436bfad08



----------------------------------------------------------------------

Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
`iommu_unmap(v->domain, map->start, map->size);`
from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
provide DMA config operations.

However, the IOMMU domain referred to by `v->domain` is freed in
vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
vhost_vdpa_release() which results in NULL pointer de-reference.
Accordingly, moving the call to vhost_vdpa_free_domain() in
vhost_vdpa_cleanup() would makes sense. This will also help
detaching the dma device in error handling of vhost_vdpa_alloc_domain().

This issue was observed on terminating QEMU with SIGQUIT.

Fixes: 037d4305 ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
Signed-off-by: default avatarGautam Dawar <gautam.dawar@amd.com>
Message-Id: <20230301163203.29883-1-gautam.dawar@amd.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Signed-off-by: default avatarjiangdongxu <jiangdongxu1@huawei.com>
parent cd281ae6

drivers/vhost/vdpa.c

+2 −1
Original line number Diff line number Diff line
@@ -1166,6 +1166,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v) 


err_attach:

	iommu_domain_free(v->domain);

	v->domain = NULL;

	return ret;

}
@@ -1214,6 +1215,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v) 
			vhost_vdpa_remove_as(v, asid);

	}



	vhost_vdpa_free_domain(v);

	vhost_dev_cleanup(&v->vdev);

	kfree(v->vdev.vqs);

}
@@ -1286,7 +1288,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) 
	vhost_vdpa_clean_irq(v);

	vhost_vdpa_reset(v);

	vhost_dev_stop(&v->vdev);

	vhost_vdpa_free_domain(v);

	vhost_vdpa_config_put(v);

	vhost_vdpa_cleanup(v);

	mutex_unlock(&d->mutex);