Skip to contentSkip to conversation

vfio: fix noiommu vfio_iommu_group_get reference count

PATCH Applied Eric Auger 2 participants 2 messages Aug 11, 2017 – Aug 30, 2017 VFIO driver

lore
Share & tools
lore

Eric Auger

author
#0 lore raw

PATCH v2 1/1 vfio: fix noiommu vfio_iommu_group_get reference count

In vfio_iommu_group_get() we want to increase the reference count of the iommu group.

In noiommu case, the group does not exist and is allocated. iommu_group_add_device() increases the group ref count. However we then call iommu_group_put() which decrements it.

This leads to a "refcount_t: underflow WARN_ON".

Only decrement the ref count in case of iommu_group_add_device failure.

Signed-off-by Eric Auger <[email protected]>

---

v1 -> v2:
put the group in case iommu_group_add_device failed

---
 drivers/vfio/vfio.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/vfio/vfio.c +3 -2
index 330d505..4ee4f36 100644
@@ -138,9 +138,10 @@ struct iommu_group *vfio_iommu_group_get(struct device *dev)
 	iommu_group_set_name(group, "vfio-noiommu");
 	iommu_group_set_iommudata(group, &noiommu, NULL);
 	ret = iommu_group_add_device(group, dev);
-	iommu_group_put(group);
-	if (ret)
+	if (ret) {
+		iommu_group_put(group);
 		return NULL;
+	}
 
 	/*
 	 * Where to taint?  At this point we've added an IOMMU group for a
Signature · 1 line
2.5.5
Applied
#1 lore raw
Quoted 14 lines · On Fri, 11 Aug 2017 15:16:06 +0200 Eric Auger <[email protected]> wrote:

In vfio_iommu_group_get() we want to increase the reference count of the iommu group.

In noiommu case, the group does not exist and is allocated. iommu_group_add_device() increases the group ref count. However we then call iommu_group_put() which decrements it.

This leads to a "refcount_t: underflow WARN_ON".

Only decrement the ref count in case of iommu_group_add_device failure.

Signed-off-by Eric Auger <[email protected]>
Quoted 7 lines

---

v1 -> v2:
put the group in case iommu_group_add_device failed

---
 drivers/vfio/vfio.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Applied to next branch for v4.14. Thanks,

Alex

Quoted 17 lines
drivers/vfio/vfio.c +3 -2
index 330d505..4ee4f36 100644
@@ -138,9 +138,10 @@ struct iommu_group *vfio_iommu_group_get(struct device *dev)
 	iommu_group_set_name(group, "vfio-noiommu");
 	iommu_group_set_iommudata(group, &noiommu, NULL);
 	ret = iommu_group_add_device(group, dev);
-	iommu_group_put(group);
-	if (ret)
+	if (ret) {
+		iommu_group_put(group);
 		return NULL;
+	}
 
 	/*
 	 * Where to taint?  At this point we've added an IOMMU group for a