diff options
| author | Gautam Dawar <gautam.dawar@amd.com> | 2023-03-01 22:02:01 +0530 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2023-03-13 02:29:11 -0400 |
| commit | 5a522150093a0eabae9470a70a37a6e436bfad08 (patch) | |
| tree | b1e47e6802a67888a1ddf6d71a835b6fd8fde3f2 /drivers/vhost/vdpa.c | |
| parent | 09e65ee9059d76b89cb713795748805efd3f50c6 (diff) | |
| download | linux-stable-5a522150093a0eabae9470a70a37a6e436bfad08.tar.gz linux-stable-5a522150093a0eabae9470a70a37a6e436bfad08.tar.bz2 linux-stable-5a522150093a0eabae9470a70a37a6e436bfad08.zip | |
vhost-vdpa: free iommu domain after last use during cleanup
Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
`iommu_unmap(v->domain, map->start, map->size);`
from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
provide DMA config operations.
However, the IOMMU domain referred to by `v->domain` is freed in
vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
vhost_vdpa_release() which results in NULL pointer de-reference.
Accordingly, moving the call to vhost_vdpa_free_domain() in
vhost_vdpa_cleanup() would makes sense. This will also help
detaching the dma device in error handling of vhost_vdpa_alloc_domain().
This issue was observed on terminating QEMU with SIGQUIT.
Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
Signed-off-by: Gautam Dawar <gautam.dawar@amd.com>
Message-Id: <20230301163203.29883-1-gautam.dawar@amd.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Diffstat (limited to 'drivers/vhost/vdpa.c')
| -rw-r--r-- | drivers/vhost/vdpa.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index dc12dbd5b43b..7be9d9d8f01c 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -1169,6 +1169,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v) err_attach: iommu_domain_free(v->domain); + v->domain = NULL; return ret; } @@ -1213,6 +1214,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v) vhost_vdpa_remove_as(v, asid); } + vhost_vdpa_free_domain(v); vhost_dev_cleanup(&v->vdev); kfree(v->vdev.vqs); } @@ -1285,7 +1287,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) vhost_vdpa_clean_irq(v); vhost_vdpa_reset(v); vhost_dev_stop(&v->vdev); - vhost_vdpa_free_domain(v); vhost_vdpa_config_put(v); vhost_vdpa_cleanup(v); mutex_unlock(&d->mutex); |