diff options
| author | Lu Baolu <baolu.lu@linux.intel.com> | 2025-01-17 13:58:00 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-21 14:01:36 +0100 |
| commit | db60d2d896a17decd58d143eef92cf22eb0a0176 (patch) | |
| tree | c66b47e60026be93fd910252ff80d733cb43ef21 | |
| parent | 2ca8802a24f7aec58279f66f121fdaaca8926051 (diff) | |
| download | linux-db60d2d896a17decd58d143eef92cf22eb0a0176.tar.gz linux-db60d2d896a17decd58d143eef92cf22eb0a0176.tar.bz2 linux-db60d2d896a17decd58d143eef92cf22eb0a0176.zip | |
iommu: Fix potential memory leak in iopf_queue_remove_device()
commit 9759ae2cee7cd42b95f1c48aa3749bd02b5ddb08 upstream.
The iopf_queue_remove_device() helper removes a device from the per-iommu
iopf queue when PRI is disabled on the device. It responds to all
outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the
device from the queue.
However, it fails to release the group structure that represents a group
of iopf's awaiting for a response after responding to the hardware. This
can cause a memory leak if iopf_queue_remove_device() is called with
pending iopf's.
Fix it by calling iopf_free_group() after the iopf group is responded.
Fixes: 199112327135 ("iommu: Track iopf group instead of last fault")
Cc: stable@vger.kernel.org
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20250117055800.782462-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/iommu/io-pgfault.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/iommu/io-pgfault.c b/drivers/iommu/io-pgfault.c index 4674e618797c..8b5926c1452e 100644 --- a/drivers/iommu/io-pgfault.c +++ b/drivers/iommu/io-pgfault.c @@ -478,6 +478,7 @@ void iopf_queue_remove_device(struct iopf_queue *queue, struct device *dev) ops->page_response(dev, iopf, &resp); list_del_init(&group->pending_node); + iopf_free_group(group); } mutex_unlock(&fault_param->lock); |