2023-03-01 16:34:51

by Gautam Dawar

Subject: [PATCH] vhost-vdpa: free iommu domain after last use during cleanup

Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
`iommu_unmap(v->domain, map->start, map->size);`
from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
provide DMA config operations.

However, the IOMMU domain referred to by `v->domain` is freed in
vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
vhost_vdpa_release() which results in NULL pointer de-reference.
Accordingly, moving the call to vhost_vdpa_free_domain() in
vhost_vdpa_cleanup() would makes sense. This will also help
detaching the dma device in error handling of vhost_vdpa_alloc_domain().

This issue was observed on terminating QEMU with SIGQUIT.

Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
Signed-off-by: Gautam Dawar <[email protected]>
---
drivers/vhost/vdpa.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index ec32f785dfde..b7657984dd8d 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v)

err_attach:
iommu_domain_free(v->domain);
+ v->domain = NULL;
return ret;
}

@@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v)
vhost_vdpa_remove_as(v, asid);
}

+ vhost_vdpa_free_domain(v);
vhost_dev_cleanup(&v->vdev);
kfree(v->vdev.vqs);
}
@@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)
vhost_vdpa_clean_irq(v);
vhost_vdpa_reset(v);
vhost_dev_stop(&v->vdev);
- vhost_vdpa_free_domain(v);
vhost_vdpa_config_put(v);
vhost_vdpa_cleanup(v);
mutex_unlock(&d->mutex);
--
2.30.1

2023-03-02 07:05:15

by Jason Wang

Subject: Re: [PATCH] vhost-vdpa: free iommu domain after last use during cleanup

On Thu, Mar 2, 2023 at 12:32 AM Gautam Dawar <[email protected]> wrote:
>
> Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
> `iommu_unmap(v->domain, map->start, map->size);`
> from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
> provide DMA config operations.
>
> However, the IOMMU domain referred to by `v->domain` is freed in
> vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
> vhost_vdpa_release() which results in NULL pointer de-reference.
> Accordingly, moving the call to vhost_vdpa_free_domain() in
> vhost_vdpa_cleanup() would makes sense. This will also help
> detaching the dma device in error handling of vhost_vdpa_alloc_domain().
>
> This issue was observed on terminating QEMU with SIGQUIT.
>
> Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
> Signed-off-by: Gautam Dawar <[email protected]>

Acked-by: Jason Wang <[email protected]>

Thanks

> ---
> drivers/vhost/vdpa.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ec32f785dfde..b7657984dd8d 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v)
>
> err_attach:
> iommu_domain_free(v->domain);
> + v->domain = NULL;
> return ret;
> }
>
> @@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v)
> vhost_vdpa_remove_as(v, asid);
> }
>
> + vhost_vdpa_free_domain(v);
> vhost_dev_cleanup(&v->vdev);
> kfree(v->vdev.vqs);
> }
> @@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)
> vhost_vdpa_clean_irq(v);
> vhost_vdpa_reset(v);
> vhost_dev_stop(&v->vdev);
> - vhost_vdpa_free_domain(v);
> vhost_vdpa_config_put(v);
> vhost_vdpa_cleanup(v);
> mutex_unlock(&d->mutex);
> --
> 2.30.1
>

2023-03-02 08:34:27

by Stefano Garzarella

Subject: Re: [PATCH] vhost-vdpa: free iommu domain after last use during cleanup

On Wed, Mar 01, 2023 at 10:02:01PM +0530, Gautam Dawar wrote:
>Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
>`iommu_unmap(v->domain, map->start, map->size);`
>from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
>provide DMA config operations.
>
>However, the IOMMU domain referred to by `v->domain` is freed in
>vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
>vhost_vdpa_release() which results in NULL pointer de-reference.
>Accordingly, moving the call to vhost_vdpa_free_domain() in
>vhost_vdpa_cleanup() would makes sense. This will also help
>detaching the dma device in error handling of vhost_vdpa_alloc_domain().

Yep, good cleanup!

>
>This issue was observed on terminating QEMU with SIGQUIT.
>
>Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
>Signed-off-by: Gautam Dawar <[email protected]>
>---
> drivers/vhost/vdpa.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Stefano Garzarella <[email protected]>