Skip to content
Commit 8e827bec authored by Prakash Gupta's avatar Prakash Gupta
Browse files

iommu: fix smmu_secure_pool access list after free issue



secure_pool_list is initialized during domain alloc and freed with domain
free.
commit e6a18bb617e4 ("iommu: free io pgtable during domain detach.") frees
the secure_pool_list as part of iommu detach sequence, and uses the same
list head as part of iommu attach.  This uncovers an existing bug where
list was not being deleted from secure_pool_list and associated memory was
being freed.  This resulted in invalid secure_pool_list head pointing to a
location already freed and resulted in kernel BUG of access after free
during iommu attach.

Call Trace:
arm_smmu_alloc_pages_exact+0x60/0x110
io_pgtable_alloc_pages_exact+0x48/0xb0
__arm_lpae_alloc_pages+0x48/0x1c0
arm_64_lpae_alloc_pgtable_s1+0x100/0x15c
alloc_io_pgtable_ops+0x54/0x88
arm_smmu_attach_dev+0x8cc/0x1144
__iommu_attach_device+0x3c/0xf4
[...]

Change-Id: I7d1b49030986da7f5d05b7e6cb9dc09079f20a41
Signed-off-by: default avatarPrakash Gupta <guptap@codeaurora.org>
parent 37d3257d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment