Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
fixed a NULL pointer dereference in an unlikely situation partly.

If dev_pasid is not found in the dev_pasids list, it remains NULL.
However, the teardown operations are executed unconditionally, this lead
to a NULL pointer dereference or refcount corruption.

If the domain was never attached to this IOMMU, info will be NULL, which
would cause an immediate dereference when checking --info->refcnt.

Even if info is not NULL, decrementing the refcount without having removed
a valid PASID might unbalance the count. This could lead to premature
dropping of the refcount to 0, potentially causing a use-after-free for the
remaining active devices sharing the domain.

Fix it by returning early if dev_pasid is NULL, before executing the
teardown operations.

Issue found by AI review and suggested by Kevin Tian.
https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com

Fixes: 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 drivers/iommu/intel/iommu.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 52aa12dbeea1..172b96f2cedf 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -3545,12 +3545,13 @@ void domain_remove_dev_pasid(struct iommu_domain *domain,
 	}
 	spin_unlock_irqrestore(&dmar_domain->lock, flags);
 
+	if (WARN_ON_ONCE(!dev_pasid))
+		return;
+
 	cache_tag_unassign_domain(dmar_domain, dev, pasid);
 	domain_detach_iommu(dmar_domain, iommu);
-	if (!WARN_ON_ONCE(!dev_pasid)) {
-		intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
-		kfree(dev_pasid);
-	}
+	intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
+	kfree(dev_pasid);
 }
 
 static int blocking_domain_set_dev_pasid(struct iommu_domain *domain,
-- 
2.47.3

On 4/22/26 11:35, Zhenzhong Duan wrote:
> Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
> fixed a NULL pointer dereference in an unlikely situation partly.
> 
> If dev_pasid is not found in the dev_pasids list, it remains NULL.
> However, the teardown operations are executed unconditionally, this lead
> to a NULL pointer dereference or refcount corruption.
> 
> If the domain was never attached to this IOMMU, info will be NULL, which
> would cause an immediate dereference when checking --info->refcnt.
> 
> Even if info is not NULL, decrementing the refcount without having removed
> a valid PASID might unbalance the count. This could lead to premature
> dropping of the refcount to 0, potentially causing a use-after-free for the
> remaining active devices sharing the domain.
> 
> Fix it by returning early if dev_pasid is NULL, before executing the
> teardown operations.
> 
> Issue found by AI review and suggested by Kevin Tian.
> https://sashiko.dev/#/patchset/20260421031347.1408890-1- 
> zhenzhong.duan%40intel.com
> 
> Fixes: 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
> Suggested-by: Kevin Tian<kevin.tian@intel.com>
> Signed-off-by: Zhenzhong Duan<zhenzhong.duan@intel.com>
> ---
>   drivers/iommu/intel/iommu.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)

Queued for v7.1-rc. Thanks!

> From: Duan, Zhenzhong <zhenzhong.duan@intel.com>
> Sent: Wednesday, April 22, 2026 11:36 AM
> 
> Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after
> WARN_ON_ONCE")
> fixed a NULL pointer dereference in an unlikely situation partly.
> 
> If dev_pasid is not found in the dev_pasids list, it remains NULL.
> However, the teardown operations are executed unconditionally, this lead
> to a NULL pointer dereference or refcount corruption.
> 
> If the domain was never attached to this IOMMU, info will be NULL, which
> would cause an immediate dereference when checking --info->refcnt.
> 
> Even if info is not NULL, decrementing the refcount without having removed
> a valid PASID might unbalance the count. This could lead to premature
> dropping of the refcount to 0, potentially causing a use-after-free for the
> remaining active devices sharing the domain.
> 
> Fix it by returning early if dev_pasid is NULL, before executing the
> teardown operations.
> 
> Issue found by AI review and suggested by Kevin Tian.
> https://sashiko.dev/#/patchset/20260421031347.1408890-1-
> zhenzhong.duan%40intel.com
> 
> Fixes: 60f030f7418d ("iommu/vt-d: Avoid use of NULL after
> WARN_ON_ONCE")
> Suggested-by: Kevin Tian <kevin.tian@intel.com>
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>