From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B38BB355F35 for ; Sun, 31 May 2026 17:03:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780246985; cv=none; b=hgT6ujyc5IPe9Ok+kRdd+a5YkpXT4dQGSVjQZssIYSPEVwQue8adDyfeYNbRnZVVdSlsT5IjWdO1Oa+njRVXjU+mgfRX/d+XGanP/XfarAEFfBEhNqu63WeV5hkM687NlY4Xs0RhmnZbaASLDlYB1T18TqM61tT9F4KfdG5ZzpI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780246985; c=relaxed/simple; bh=YgLJf47j2rvL5UzJW0CWIyQNsMhK13ggWUOSMGN3lnI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Xg1HmD/OfBqztYAa0jO7VNHAuHkXxz3B9qeljEFslIJUy49pZt5L++E3mLKZGVQTmxuNBjZ1KfgkcK1S+W1t4r+a5dUJjkHRMs6NpvzKY8vh7FbBFYLeKnwMX+eNoQfJ/flKBBk2FHdjigF/iCzzQ0U6vKcVzXiXQvSZozDiaII= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--praan.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=puGD2ZzS; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--praan.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="puGD2ZzS" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2c0bf6904a6so12135905ad.1 for ; Sun, 31 May 2026 10:03:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780246984; x=1780851784; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=61nUYKvRFkNmEacFmLV+B7OCu4lQy5aTJXNSuY6+Mt4=; b=puGD2ZzSuQSNUEsaCKmrnOTXv+3d/LQAkK+ZIrxfSFnS3hmZRrVC8PpmokkiIhIxle iQVtrMKU/nm5vWVKGH7CucmCNjqbe8WUK4TGDBND89cT1cf7OWGevXIzVLS7Q1KEvBDq stzvvRXPfAEc9UNcChtZZ0Iab8c9OQYNkJsndCbEslkUk7q5Qw+LIFKf3q8HRFkdx0GC BJJ48P+iv9Cn3drZpaH+ObbLfULBxEDOpXI1YvNXDL+wq4dx6KhOWzuiUvZks8/2G/Cj nVlOp+OJ66hyupwxnlb1cEax3zoVpdexutuDwRa6ayPnZ3X8jlB0kT7eKvdhjkf47759 +khw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780246984; x=1780851784; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=61nUYKvRFkNmEacFmLV+B7OCu4lQy5aTJXNSuY6+Mt4=; b=QewlmsgPcWYUbwj2M92JO6aAxCTS5P2hcxRw1VxCIgsiMigGXjzmpfqNUiKcu6PUEQ xpcKuh6EOrPN10B2xroALfjlK1MzNDPbWFuK2yd3n411Ky0axTAkwGanjrGVYABoduA2 JZSiab28jD6N1knpUTZuoQUv5pGdcSRCTb+V47mA+5qQ+NhKydukrkN9XDnXwJPZuDM0 0vPg9z+5GutZ+abf5zCT1d2WurHvLxp/icSNd048hCqzw9SQfTcuA+BvJWWS4UOqQq7H TBHlrJlMa4E/P1q5Gx96dw68TqKzAgOWmVVMb+GvamTx4ceoeRMiL7vip5vPS2yXzP16 oKuQ== X-Forwarded-Encrypted: i=1; AFNElJ9baEv9TD6Y8r04XdpMH3f0kA/o3MAfO8sDeZOhIrfj7eX/VEV69mrO+Ppabmp5pN24W9o8gcGi1EdNL9E=@vger.kernel.org X-Gm-Message-State: AOJu0YxGgd+vDTj7ayiw2/6MfTn2PcDhsyB5QrGgpvnv0DIFgW+xM5C1 j+kmSKwg7nFGUwTzoiaj/ZfmySak9psaky5bocjFR10D7MITcHgNcgpzwRLn0G9/AqUZYprx4vX X7A== X-Received: from plxj16.prod.google.com ([2002:a17:902:da90:b0:2bf:2cd5:1d4a]) (user=praan job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:1b4d:b0:2bf:2015:5b93 with SMTP id d9443c01a7336-2bf367d9879mr94331165ad.11.1780246983783; Sun, 31 May 2026 10:03:03 -0700 (PDT) Date: Sun, 31 May 2026 17:02:54 +0000 In-Reply-To: <20260531170254.60493-1-praan@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260531170254.60493-1-praan@google.com> X-Mailer: git-send-email 2.54.0.823.g6e5bcc1fc9-goog Message-ID: <20260531170254.60493-3-praan@google.com> Subject: [PATCH v2 2/2] iommu/vt-d: Fix Use-After-Free in probe error path From: Pranjal Shrivastava To: iommu@lists.linux.dev, linux-kernel@vger.kernel.org Cc: David Woodhouse , Lu Baolu , Joerg Roedel , Will Deacon , Robin Murphy , Kevin Tian , Samiullah Khawaja , Pranjal Shrivastava , sashiko-bot@kernel.org Content-Type: text/plain; charset="UTF-8" When intel_iommu_probe_device() fails after the info structure has been linked to the device via dev_iommu_priv_set(), the error path calls kfree(info) but does not clear the pointer in the device structure. This results in a Use-After-Free regression if the pointer is accessed by a subsequent IOMMU core call or a re-probe. Fix this by ensuring dev_iommu_priv_set(dev, NULL) is called before freeing the info structure in the error path. Fixes: eda1a94caf6b ("iommu: Mark dev_iommu_priv_set() with a lockdep") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel.org/ Signed-off-by: Pranjal Shrivastava --- drivers/iommu/intel/iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 2702e9aa2241..6c718adf97ae 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -3320,6 +3320,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev) clear_rbtree: device_rbtree_remove(info); free: + dev_iommu_priv_set(dev, NULL); kfree(info); return ERR_PTR(ret); -- 2.54.0.823.g6e5bcc1fc9-goog