Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-18 06:15:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

vfio/spapr_tce: Fix incorrect tce_iommu_group memory free

Browse Source 
The @tcegrp variable is used in 1) a loop over attached groups
2) it stores a pointer to a newly allocated tce_iommu_group if 1) found
nothing. However the error handler does not distinguish how we got there
and incorrectly releases memory for a found+incompatible group.

This fixes it by adding another error handling case.

Fixes: 0bd971676e68 ("powerpc/powernv/npu: Add compound IOMMU groups")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
This commit is contained in:
Alexey Kardashevskiy 2019-08-19 11:51:17 +10:00 committed by Alex Williamson
parent d1abaeb3be
commit 78becab98b
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/vfio/vfio_iommu_spapr_tce.c
View File

@ -1234,7 +1234,7 @@ release_exit:
static int tce_iommu_attach_group(void *iommu_data,
struct iommu_group *iommu_group)
{
int ret;
int ret = 0;
struct tce_container *container = iommu_data;
struct iommu_table_group *table_group;
struct tce_iommu_group *tcegrp = NULL;
@ -1287,13 +1287,13 @@ static int tce_iommu_attach_group(void *iommu_data,
!table_group->ops->release_ownership) {
if (container->v2) {
ret = -EPERM;
goto unlock_exit;
goto free_exit;
}
ret = tce_iommu_take_ownership(container, table_group);
} else {
if (!container->v2) {
ret = -EPERM;
goto unlock_exit;
goto free_exit;
}
ret = tce_iommu_take_ownership_ddw(container, table_group);
if (!tce_groups_attached(container) && !container->tables[0])
@ -1305,10 +1305,11 @@ static int tce_iommu_attach_group(void *iommu_data,
list_add(&tcegrp->next, &container->group_list);
}
unlock_exit:
free_exit:
if (ret && tcegrp)
kfree(tcegrp);
unlock_exit:
mutex_unlock(&container->lock);
return ret;