[PATCH] iommufd: Fix NULL deref of area->pages in ioas_change_process
Deepanshu Kartikey <[email protected]>
| Newsgroups | dev.linux.lists.iommu,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
Areas are inserted into the area_itree before area->pages is assigned,
so an area with a NULL pages pointer is briefly visible to readers.
iommufd_ioas_change_process() walks every area and dereferences
area->pages unconditionally, which oopses when racing with a
concurrent IOMMU_IOAS_MAP_FILE.
Reject the racing case with -EBUSY, matching how
iopt_unmap_iova_range() handles the same window. Checking in the first
loop covers the whole function since all iova_rwsems are held for
write across the call.
Fixes: 829ed626499c ("iommufd: Add IOMMU_IOAS_CHANGE_PROCESS")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=48637757323884de77a2
Tested-by: [email protected]
Signed-off-by: Deepanshu Kartikey <[email protected]>
---
drivers/iommu/iommufd/ioas.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
index fed06c2b728e..71bffece84b5 100644
--- a/drivers/iommu/iommufd/ioas.c
+++ b/drivers/iommu/iommufd/ioas.c
@@ -535,6 +535,10 @@ int iommufd_ioas_change_process(struct iommufd_ucmd *ucmd)
return rc;
for_each_ioas_area(&ioas_list, index, ioas, area) {
+ if (!area->pages) {
+ rc = -EBUSY;
+ goto out;
+ }
if (area->pages->type != IOPT_ADDRESS_FILE) {
rc = -EINVAL;
goto out;
--
2.34.1