iommufd: Fix NULL deref of area->pages in ioas_change_process

[PATCH] iommufd: Fix NULL deref of area->pages in ioas_change_process

Posted by Deepanshu Kartikey 1 month, 1 week ago

Areas are inserted into the area_itree before area->pages is assigned,
so an area with a NULL pages pointer is briefly visible to readers.
iommufd_ioas_change_process() walks every area and dereferences
area->pages unconditionally, which oopses when racing with a
concurrent IOMMU_IOAS_MAP_FILE.

Reject the racing case with -EBUSY, matching how
iopt_unmap_iova_range() handles the same window. Checking in the first
loop covers the whole function since all iova_rwsems are held for
write across the call.

Fixes: 829ed626499c ("iommufd: Add IOMMU_IOAS_CHANGE_PROCESS")
Reported-by: syzbot+48637757323884de77a2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48637757323884de77a2
Tested-by: syzbot+48637757323884de77a2@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/iommu/iommufd/ioas.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
index fed06c2b728e..71bffece84b5 100644
--- a/drivers/iommu/iommufd/ioas.c
+++ b/drivers/iommu/iommufd/ioas.c
@@ -535,6 +535,10 @@ int iommufd_ioas_change_process(struct iommufd_ucmd *ucmd)
 		return rc;
 
 	for_each_ioas_area(&ioas_list, index, ioas, area)  {
+		if (!area->pages) {
+			rc = -EBUSY;
+			goto out;
+		}
 		if (area->pages->type != IOPT_ADDRESS_FILE) {
 			rc = -EINVAL;
 			goto out;
-- 
2.34.1

Re: [PATCH] iommufd: Fix NULL deref of area->pages in ioas_change_process

Posted by Tushar Nimkar 1 month, 1 week ago

Hey Kartikey,

On 8/18/2026 9:06 AM, Deepanshu Kartikey wrote:
> [You don't often get email from kartikey406@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Caution: This message originated from an External Source. Use proper caution when opening attachments, clicking links, or responding.
>
>
> Areas are inserted into the area_itree before area->pages is assigned,
> so an area with a NULL pages pointer is briefly visible to readers.
> iommufd_ioas_change_process() walks every area and dereferences
> area->pages unconditionally, which oopses when racing with a
> concurrent IOMMU_IOAS_MAP_FILE.
>
> Reject the racing case with -EBUSY, matching how
> iopt_unmap_iova_range() handles the same window. Checking in the first
> loop covers the whole function since all iova_rwsems are held for
> write across the call.

This is same as submitted by Peiyang

https://lore.kernel.org/all/7344B7A7B9957A65+20260806045059.1884737-1-peiyang_he@smail.nju.edu.cn/ 


- tushar

> Fixes: 829ed626499c ("iommufd: Add IOMMU_IOAS_CHANGE_PROCESS")
> Reported-by: syzbot+48637757323884de77a2@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=48637757323884de77a2
> Tested-by: syzbot+48637757323884de77a2@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>   drivers/iommu/iommufd/ioas.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
> index fed06c2b728e..71bffece84b5 100644
> --- a/drivers/iommu/iommufd/ioas.c
> +++ b/drivers/iommu/iommufd/ioas.c
> @@ -535,6 +535,10 @@ int iommufd_ioas_change_process(struct iommufd_ucmd *ucmd)
>                  return rc;
>
>          for_each_ioas_area(&ioas_list, index, ioas, area)  {
> +               if (!area->pages) {
> +                       rc = -EBUSY;
> +                       goto out;
> +               }
>                  if (area->pages->type != IOPT_ADDRESS_FILE) {
>                          rc = -EINVAL;
>                          goto out;
> --
> 2.34.1
>
>