diff options
| author | Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> | 2023-05-08 23:07:16 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-04 14:40:22 +0200 |
| commit | bc952bf4e07d0f15e77c6484b26e1d0058d6912f (patch) | |
| tree | b81d467cf9d8a7833a22856c96513d1ced925109 /drivers/dma | |
| parent | 50026aa530a693a848827c6371a3cc9476fd299b (diff) | |
| download | linux-bc952bf4e07d0f15e77c6484b26e1d0058d6912f.tar.gz linux-bc952bf4e07d0f15e77c6484b26e1d0058d6912f.tar.bz2 linux-bc952bf4e07d0f15e77c6484b26e1d0058d6912f.zip | |
dmaengine: idxd: Fix passing freed memory in idxd_cdev_open()
commit 0642287e3ecdd0d1f88e6a2e63768e16153a990c upstream.
Smatch warns:
drivers/dma/idxd/cdev.c:327:
idxd_cdev_open() warn: 'sva' was already freed.
When idxd_wq_set_pasid() fails, the current code unbinds sva and then
goes to 'failed_set_pasid' where iommu_sva_unbind_device is called
again causing the above warning.
[ device_user_pasid_enabled(idxd) is still true when calling
failed_set_pasid ]
Fix this by removing additional unbind when idxd_wq_set_pasid() fails
Fixes: b022f59725f0 ("dmaengine: idxd: add idxd_copy_cr() to copy user completion record during page fault handling")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Acked-by: Fenghua Yu <fenghua.yu@intel.com>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20230509060716.2830630-1-harshit.m.mogalapalli@oracle.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/dma')
| -rw-r--r-- | drivers/dma/idxd/cdev.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c index d736ab15ade2..9b07474f450b 100644 --- a/drivers/dma/idxd/cdev.c +++ b/drivers/dma/idxd/cdev.c @@ -142,7 +142,6 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp) if (wq_dedicated(wq)) { rc = idxd_wq_set_pasid(wq, pasid); if (rc < 0) { - iommu_sva_unbind_device(sva); dev_err(dev, "wq set pasid failed: %d\n", rc); goto failed_set_pasid; } |