[PATCH 0/2] iommu/vt-d: Fix issues on probe error path

[PATCH 0/2] iommu/vt-d: Fix issues on probe error path

[Pranjal Shrivastava]

This series addresses two pre-existing issues in the Intel VT-d driver's
probe error path. These issues were identified by Sashiko during the
review of the ATS series [1].

The first patch fixes an RB-tree corruption that occurs when probing
non-ATS devices. The second patch fixes a UAF by ensuring the per-device
private data pointer is cleared before freeing memory on failure.

[1] https://sashiko.dev/#/patchset/20260525184347.4059549-1-praan@google.com?part=4

v2
- Updated the Fixes tag for Patch 2 based on feedback from Lu.

Thanks,
Praan

Pranjal Shrivastava (2):
  iommu/vt-d: Fix RB-tree corruption in probe error path
  iommu/vt-d: Fix Use-After-Free in probe error path

 drivers/iommu/intel/iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

-- 
2.54.0.823.g6e5bcc1fc9-goog

[PATCH v2 1/2] iommu/vt-d: Fix RB-tree corruption in probe error path

[Pranjal Shrivastava]

The info->node RB-tree member is zero-initialized via kzalloc. If
a device does not support ATS, the device_rbtree_insert() call is
skipped. If a subsequent probe step fails, the error path jumps to
device_rbtree_remove(), which misinterprets the zeroed node as
a tree root and corrupts the device RB-tree.

Fix this by explicitly initializing the RB-node as empty using
RB_CLEAR_NODE() during initialization and guarding the removal with
RB_EMPTY_NODE().

Fixes: 4f1492efb495 ("iommu/vt-d: Revert ATS timing change to fix boot failure")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel.org/
Suggested-by: Baolu Lu <baolu.lu@linux.intel.com>
Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
 drivers/iommu/intel/iommu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index c3d18cd77d2f..2702e9aa2241 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -157,7 +157,10 @@ static void device_rbtree_remove(struct device_domain_info *info)
 	unsigned long flags;
 
 	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
-	rb_erase(&info->node, &iommu->device_rbtree);
+	if (!RB_EMPTY_NODE(&info->node)) {
+		rb_erase(&info->node, &iommu->device_rbtree);
+		RB_CLEAR_NODE(&info->node);
+	}
 	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
 }
 
@@ -3254,6 +3257,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
 
 	info->dev = dev;
 	info->iommu = iommu;
+	RB_CLEAR_NODE(&info->node);
 	if (dev_is_pci(dev)) {
 		if (ecap_dev_iotlb_support(iommu->ecap) &&
 		    pci_ats_supported(pdev) &&
-- 
2.54.0.823.g6e5bcc1fc9-goog

[PATCH v2 2/2] iommu/vt-d: Fix Use-After-Free in probe error path

[Pranjal Shrivastava]

When intel_iommu_probe_device() fails after the info structure has
been linked to the device via dev_iommu_priv_set(), the error path
calls kfree(info) but does not clear the pointer in the device
structure.

This results in a Use-After-Free regression if the pointer is accessed
by a subsequent IOMMU core call or a re-probe.

Fix this by ensuring dev_iommu_priv_set(dev, NULL) is called before
freeing the info structure in the error path.

Fixes: eda1a94caf6b ("iommu: Mark dev_iommu_priv_set() with a lockdep")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel.org/
Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
 drivers/iommu/intel/iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 2702e9aa2241..6c718adf97ae 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -3320,6 +3320,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
 clear_rbtree:
 	device_rbtree_remove(info);
 free:
+	dev_iommu_priv_set(dev, NULL);
 	kfree(info);
 
 	return ERR_PTR(ret);
-- 
2.54.0.823.g6e5bcc1fc9-goog

Re: [PATCH 0/2] iommu/vt-d: Fix issues on probe error path

[Baolu Lu]

On 6/1/26 01:02, Pranjal Shrivastava wrote:
> This series addresses two pre-existing issues in the Intel VT-d driver's
> probe error path. These issues were identified by Sashiko during the
> review of the ATS series [1].
> 
> The first patch fixes an RB-tree corruption that occurs when probing
> non-ATS devices. The second patch fixes a UAF by ensuring the per-device
> private data pointer is cleared before freeing memory on failure.
> 
> [1]https://sashiko.dev/#/patchset/20260525184347.4059549-1- 
> praan@google.com?part=4
> 
> v2
> - Updated the Fixes tag for Patch 2 based on feedback from Lu.
> 
> Thanks,
> Praan
> 
> Pranjal Shrivastava (2):
>    iommu/vt-d: Fix RB-tree corruption in probe error path
>    iommu/vt-d: Fix Use-After-Free in probe error path
> 
>   drivers/iommu/intel/iommu.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)

Queued these two fix patches for linux-next.

I noticed that Sashiko reported two pre-existing issues here:

https://sashiko.dev/#/patchset/20260531170254.60493-1-praan%40google.com

I will follow up with fixes for them in separate patches.

Thanks,
baolu

[PATCH 0/2] iommu/vt-d: Fix issues on probe error path

[Pranjal Shrivastava]

This series addresses two pre-existing issues in the Intel VT-d driver's
probe error path. These issues were identified by Sashiko during the
review of the ATS series [1].

The first patch fixes an RB-tree corruption that occurs when probing
non-ATS devices. The second patch fixes a UAF by ensuring the per-device
private data pointer is cleared before freeing memory on failure.

[1] https://sashiko.dev/#/patchset/20260525184347.4059549-1-praan@google.com?part=4

Thanks,
Praan

Pranjal Shrivastava (2):
  iommu/vt-d: Fix RB-tree corruption in probe error path
  iommu/vt-d: Fix Use-After-Free in probe error path

 drivers/iommu/intel/iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

-- 
2.54.0.823.g6e5bcc1fc9-goog