[PATCH 6.6] iommu/sva: move x86 disable check before allocation

From: Wei Yang <[email protected]>

Backport of commit 72f98ef9a4be ("iommu: disable SVA when CONFIG_X86 is
set") placed the IS_ENABLED(CONFIG_X86) early-return in
iommu_sva_bind_device() after iommu_sva_alloc_pasid() and kzalloc(handle),
while upstream puts it at the function start.

On x86 this leaks the kzalloc'd struct iommu_sva (early return skips
kfree) and a globally allocated PASID (mm->pasid wrongly set, never
unbound). Move the check before any allocation/side effect.

Fixes: 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")

Signed-off-by: Wei Yang <[email protected]>
---

This is a stable-only fix for the linux-6.6.y tree.

The buggy commit 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")
is a backport of upstream commit 72f98ef9a4be ("iommu: disable SVA when
CONFIG_X86 is set") to 6.6. The upstream version places the
IS_ENABLED(CONFIG_X86) early-return at the start of iommu_sva_bind_device(),
but the 6.6 backport placed it after iommu_sva_alloc_pasid() and
kzalloc(handle), causing the leak described above. The upstream/mainline
code is correct, so this fix is not needed there and only applies to 6.6.

Please double-check against upstream commit 72f98ef9a4be before applying.
---
 drivers/iommu/iommu-sva.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
index 611733c02b7c..a340b805b82b 100644
--- a/drivers/iommu/iommu-sva.c
+++ b/drivers/iommu/iommu-sva.c
@@ -62,6 +62,9 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
 	struct iommu_sva *handle;
 	int ret;
 
+	if (IS_ENABLED(CONFIG_X86))
+		return ERR_PTR(-EOPNOTSUPP);
+
 	/* Allocate mm->pasid if necessary. */
 	ret = iommu_sva_alloc_pasid(mm, dev);
 	if (ret)
@@ -71,9 +74,6 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
 	if (!handle)
 		return ERR_PTR(-ENOMEM);
 
-	if (IS_ENABLED(CONFIG_X86))
-		return ERR_PTR(-EOPNOTSUPP);
-
 	mutex_lock(&iommu_sva_lock);
 	/* Search for an existing domain. */
 	domain = iommu_get_domain_for_dev_pasid(dev, mm->pasid,
-- 
2.43.7