Date:   Wed, 22 Feb 2023 08:58:30 -0400
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     Yan Zhao <yan.y.zhao@intel.com>
Cc:     alex.williamson@redhat.com, kevin.tian@intel.com,
        yi.l.liu@intel.com, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] vfio: Fix NULL pointer dereference caused by
 uninitialized group->iommufd
Message-ID: <Y/YRdkUQPG8Mli1H@nvidia.com>
References: <20230222074938.13681-1-yan.y.zhao@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230222074938.13681-1-yan.y.zhao@intel.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?7V9BE6jQUKjFnbf44zRHvSAdbCad/aV3+4sso4uETj9/DRSViroWYFQNr3Sa?=
 =?us-ascii?Q?rUqXSve/15l20xjP1EiXGLvQi8F9I3RnMIxYysorV+sRbBLonUpJ6z8ljhs5?=
 =?us-ascii?Q?DcxFlTjW4kr2cPWSkwATkody4w6VoPRCtCiPV/SJqSyC6leitrF8SigBS+An?=
 =?us-ascii?Q?j8FO+LUzkw6EfNPQJZFnyNiAlH94TMXUdC959rFhfjoJiGvrwRYfOqq9IDl3?=
 =?us-ascii?Q?Hd5Vis+4ME/ru7hkR2SjthLwUQFcTtCBSE8bc+gNMUyNBtyRmzcngoyaj9pj?=
 =?us-ascii?Q?tQidh9Q5OA96SZIhxuz2B9XtgsadETwCTDr66vUODFEMtmhaWcsIgyP+UvwH?=
 =?us-ascii?Q?9RSQuwg5/ZU21jdwVf/JW7yJeUsp4g99YmowFoNwy6aaixULxeff4+HIALgi?=
 =?us-ascii?Q?zcokZjBsatNIZRo7o1u13RHOEptQj71pKIvCP1jRtsC9fHFBorzGstCdQxpT?=
 =?us-ascii?Q?5Hb+zZC5qI9Hd+3GdY7UjJ7tMortTEUDiUqLHatVOP5gpgSA6OszVSqCiju8?=
 =?us-ascii?Q?YIY1lbvkQvJ5nFJh9nd2Pn/oEl+eklmcRdyUaWgaZHptdRWHHJp3l0cneC26?=
 =?us-ascii?Q?7vpPzw/bAhKNWyku+Nf5pTXilay0gWW5QFFeDEHKTBuku6djMNt3vhQAHYmU?=
 =?us-ascii?Q?7KUcZRLHYtXHhThNP3XPHT5mGr/LmBcjCXqg7k39pOwANhPgAmILd8CPHidS?=
 =?us-ascii?Q?fVzjvjd3tJJxwrDUKbWaYQLQ/+UIOf6WhBrLOCvCUWFMrif86v1MrT/eRhjk?=
 =?us-ascii?Q?GBSymzpKFtjWzjbDsthEbxeTB29PmCYUkyAnUkjf93dGW5T/bFtzdVSpwdf6?=
 =?us-ascii?Q?a4XXasMQScMLSCBFEHar2qHe3JJx2CzIxhaqU9vVftJpS4w6HPh7Oxvel9lB?=
 =?us-ascii?Q?n5SmyxzE02qy8k6uL6+X9RCJ4fqImLDByPim0xlf300ZKeEg1U9lQ6bIx0n+?=
 =?us-ascii?Q?B1oGTk/ap73sCYXp2650+RIMQaqYJ9XTKB80022SXYMoUnbKWzAEOLmB8/U0?=
 =?us-ascii?Q?npox7N+cPmfjhg813XuYlTIE6UXbWn6xCKC6RipDNYD6CkckgDMFE1wKHS1u?=
 =?us-ascii?Q?dXoRsO83Mul4xnOl5pkBYDMXsWGzvgbaqrzf1O211CSRosZPL/RziFxPTWXd?=
 =?us-ascii?Q?mq6QX5ShWa6+7CWB/zEfgPt7DWraDp7fPIcUZLLEuxnizpD4M//5/mFzILfl?=
 =?us-ascii?Q?FQTSulLoy+a9OmgZkEysCIMiPM8KMlMjfSstd/s62gUDLsPgct/lD6jO5/Pm?=
 =?us-ascii?Q?UhhhL4nnHgc/AYPKFRttebYqAOLomzBoC0DV13Gw3qXi9PWa/HMkeLbumc9f?=
 =?us-ascii?Q?RLoBImhTgllBtjC7IQNNcLV0XyEaH3ujMhkmMBewmbL10XCdmNc22SLstBlx?=
 =?us-ascii?Q?xfomhIBxOEfSlzU8sxeMg0B9ZKNi20VxfUED8gRMy20KEW8JrGSUWuPDCN7d?=
 =?us-ascii?Q?VxbfXS1fE90C9l8MJ+QkNMgDfq77U1no8ScUNHILWdfMZ56+HB4FBo2LY9TU?=
 =?us-ascii?Q?eF7pAscrSHqvkrWSMHdCW0iW4vN++CukFmHtDDKk80C/aViCISD1ib1e9o/W?=
 =?us-ascii?Q?Fg/CwPfq5wC2ne2WWZtQ6Y50rTHIP2SyDIzfbhw0?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 92c65351-aa0b-4f4f-bfb5-08db14d47f96
X-MS-Exchange-CrossTenant-AuthSource: LV2PR12MB5869.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2023 12:58:31.0338
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: x8+Vd/sgyBOmjm8aV+ueNuI2dwDEKOuwz5CQP8JHoPriVdBPPHx8tgdknm4TseSC
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB4038
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Feb 22, 2023 at 03:49:38PM +0800, Yan Zhao wrote:
> group->iommufd is not initialized for the iommufd_ctx_put()
> 
> [20018.331541] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [20018.377508] RIP: 0010:iommufd_ctx_put+0x5/0x10 [iommufd]
> ...
> [20018.476483] Call Trace:
> [20018.479214]  <TASK>
> [20018.481555]  vfio_group_fops_unl_ioctl+0x506/0x690 [vfio]
> [20018.487586]  __x64_sys_ioctl+0x6a/0xb0
> [20018.491773]  ? trace_hardirqs_on+0xc5/0xe0
> [20018.496347]  do_syscall_64+0x67/0x90
> [20018.500340]  entry_SYSCALL_64_after_hwframe+0x4b/0xb5
> 
> Fixes: 9eefba8002c2 ("vfio: Move vfio group specific code into group.c")
> Signed-off-by: Yan Zhao <yan.y.zhao@intel.com>
> ---
>  drivers/vfio/group.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason