aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJacob Pan <jacob.jun.pan@linux.intel.com>2020-03-19 21:32:30 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-04-23 10:38:18 +0200
commit2cf6e0ec9b7f970904e97a6d886862e974e3188b (patch)
treec5d5d65a941b988442b5c4dc8a013a168c74971c
parent06cf124d3dbbfb71d01f87a2d9401af9a457c266 (diff)
downloadlinux-yocto-2cf6e0ec9b7f970904e97a6d886862e974e3188b.tar.gz
linux-yocto-2cf6e0ec9b7f970904e97a6d886862e974e3188b.tar.bz2
linux-yocto-2cf6e0ec9b7f970904e97a6d886862e974e3188b.zip
iommu/vt-d: Fix mm reference leak
[ Upstream commit 902baf61adf6b187f0a6b789e70d788ea71ff5bc ] Move canonical address check before mmget_not_zero() to avoid mm reference leak. Fixes: 9d8c3af31607 ("iommu/vt-d: IOMMU Page Request needs to check if address is canonical.") Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com> Acked-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r--drivers/iommu/intel-svm.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index d7f2a5358900..fc7d78876e02 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -611,14 +611,15 @@ static irqreturn_t prq_event_thread(int irq, void *d)
* any faults on kernel addresses. */
if (!svm->mm)
goto bad_req;
- /* If the mm is already defunct, don't handle faults. */
- if (!mmget_not_zero(svm->mm))
- goto bad_req;
/* If address is not canonical, return invalid response */
if (!is_canonical_address(address))
goto bad_req;
+ /* If the mm is already defunct, don't handle faults. */
+ if (!mmget_not_zero(svm->mm))
+ goto bad_req;
+
down_read(&svm->mm->mmap_sem);
vma = find_extend_vma(svm->mm, address);
if (!vma || address < vma->vm_start)