[lkml]   [2017]   [Jul]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 4.9 159/172] iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
    4.9-stable review patch.  If anyone has any objections, please let me know.


    From: Pan Bian <>

    commit 73dbd4a4230216b6a5540a362edceae0c9b4876b upstream.

    In function amd_iommu_bind_pasid(), the control flow jumps
    to label out_free when pasid_state->mm and mm is NULL. And
    mmput(mm) is called. In function mmput(mm), mm is
    referenced without validation. This will result in a NULL
    dereference bug. This patch fixes the bug.

    Signed-off-by: Pan Bian <>
    Fixes: f0aac63b873b ('iommu/amd: Don't hold a reference to mm_struct')
    Signed-off-by: Joerg Roedel <>
    Signed-off-by: Greg Kroah-Hartman <>

    drivers/iommu/amd_iommu_v2.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/iommu/amd_iommu_v2.c
    +++ b/drivers/iommu/amd_iommu_v2.c
    @@ -695,9 +695,9 @@ out_clear_state:

    mmu_notifier_unregister(&pasid_state->mn, mm);
    + mmput(mm);

    - mmput(mm);


     \ /
      Last update: 2017-07-03 16:14    [W:3.539 / U:0.536 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site