From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751488AbdH3VXn (ORCPT ); Wed, 30 Aug 2017 17:23:43 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45394 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750885AbdH3VXm (ORCPT ); Wed, 30 Aug 2017 17:23:42 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 256874A6F5 Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=alex.williamson@redhat.com Date: Wed, 30 Aug 2017 15:23:31 -0600 From: Alex Williamson To: Eric Auger Cc: eric.auger.pro@gmail.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] vfio: fix noiommu vfio_iommu_group_get reference count Message-ID: <20170830152331.7cf8c30d@w520.home> In-Reply-To: <1502457366-3562-1-git-send-email-eric.auger@redhat.com> References: <1502457366-3562-1-git-send-email-eric.auger@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Wed, 30 Aug 2017 21:23:42 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 11 Aug 2017 15:16:06 +0200 Eric Auger wrote: > In vfio_iommu_group_get() we want to increase the reference > count of the iommu group. > > In noiommu case, the group does not exist and is allocated. > iommu_group_add_device() increases the group ref count. However we > then call iommu_group_put() which decrements it. > > This leads to a "refcount_t: underflow WARN_ON". > > Only decrement the ref count in case of iommu_group_add_device > failure. > > Signed-off-by: Eric Auger > > --- > > v1 -> v2: > put the group in case iommu_group_add_device failed > --- > drivers/vfio/vfio.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) Applied to next branch for v4.14. Thanks, Alex > diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c > index 330d505..4ee4f36 100644 > --- a/drivers/vfio/vfio.c > +++ b/drivers/vfio/vfio.c > @@ -138,9 +138,10 @@ struct iommu_group *vfio_iommu_group_get(struct device *dev) > iommu_group_set_name(group, "vfio-noiommu"); > iommu_group_set_iommudata(group, &noiommu, NULL); > ret = iommu_group_add_device(group, dev); > - iommu_group_put(group); > - if (ret) > + if (ret) { > + iommu_group_put(group); > return NULL; > + } > > /* > * Where to taint? At this point we've added an IOMMU group for a