summaryrefslogtreecommitdiff
path: root/drivers/iommu/amd_iommu_v2.c
diff options
context:
space:
mode:
authorJoerg Roedel <jroedel@suse.de>2015-10-09 16:23:33 +0200
committerJoerg Roedel <jroedel@suse.de>2015-10-09 17:59:33 +0200
commit5adad9915472e180712030d730cdc476c6f8a60b (patch)
treea389220151e1a30590004ad0d2fa74911fd22d9c /drivers/iommu/amd_iommu_v2.c
parentcbbc00be2ce3af5d708226a9563fa27cb4e6b6b8 (diff)
downloadlwn-5adad9915472e180712030d730cdc476c6f8a60b.tar.gz
lwn-5adad9915472e180712030d730cdc476c6f8a60b.zip
iommu/amd: Fix NULL pointer deref on device detach
When a device group is detached from its domain, the iommu core code calls into the iommu driver to detach each device individually. Before this functionality went into the iommu core code, it was implemented in the drivers, also in the AMD IOMMU driver as the device alias handling code. This code is still present, as there might be aliases that don't exist as real PCI devices (and are therefore invisible to the iommu core code). Unfortunatly it might happen now, that a device is unbound multiple times from its domain, first by the alias handling code and then by the iommu core code (or vice verca). This ends up in the do_detach function which dereferences the dev_data->domain pointer. When the device is already detached, this pointer is NULL and we get a kernel oops. Removing the alias code completly is not an option, as that would also remove the code which handles invisible aliases. The code could be simplified, but this is too big of a change outside the merge window. For now, just check the dev_data->domain pointer in do_detach and bail out if it is NULL. Reported-by: Andreas Hartmann <andihartmann@freenet.de> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Diffstat (limited to 'drivers/iommu/amd_iommu_v2.c')
0 files changed, 0 insertions, 0 deletions