• Joerg Roedel's avatar
    iommu/amd: Fix NULL pointer deref on device detach · 5adad991
    Joerg Roedel authored
    When a device group is detached from its domain, the iommu
    core code calls into the iommu driver to detach each device
    individually.
    
    Before this functionality went into the iommu core code, it
    was implemented in the drivers, also in the AMD IOMMU
    driver as the device alias handling code.
    
    This code is still present, as there might be aliases that
    don't exist as real PCI devices (and are therefore invisible
    to the iommu core code).
    
    Unfortunatly it might happen now, that a device is unbound
    multiple times from its domain, first by the alias handling
    code and then by the iommu core code (or vice verca).
    
    This ends up in the do_detach function which dereferences
    the dev_data->domain pointer. When the device is already
    detached, this pointer is NULL and we get a kernel oops.
    
    Removing the alias code completly is not an option, as that
    would also remove the code which handles invisible aliases.
    The code could be simplified, but this is too big of a
    change outside the merge window.
    
    For now, just check the dev_data->domain pointer in
    do_detach and bail out if it is NULL.
    Reported-by: default avatarAndreas Hartmann <andihartmann@freenet.de>
    Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
    5adad991
amd_iommu.c 94.4 KB