For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] iommufd: Fix NULL deref of area->pages in ioas_change_process
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Areas are inserted into the area_itree before area->pages is assigned,
so an area with a NULL pages pointer is briefly visible to readers.
iommufd_ioas_change_process() walks every area and dereferences
area->pages unconditionally, which oopses when racing with a
concurrent IOMMU_IOAS_MAP_FILE.
Reject the racing case with -EBUSY, matching how
iopt_unmap_iova_range() handles the same window. Checking in the first
loop covers the whole function since all iova_rwsems are held for
write across the call.
Reported-by: syzbot+48637757323884de77a2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48637757323884de77a2
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/iommu/iommufd/ioas.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
index fed06c2b728e..71bffece84b5 100644
--- a/drivers/iommu/iommufd/ioas.c
+++ b/drivers/iommu/iommufd/ioas.c
@@ -535,6 +535,10 @@ int iommufd_ioas_change_process(struct iommufd_ucmd *ucmd)
return rc;
for_each_ioas_area(&ioas_list, index, ioas, area) {
+ if (!area->pages) {
+ rc = -EBUSY;
+ goto out;
+ }
if (area->pages->type != IOPT_ADDRESS_FILE) {
rc = -EINVAL;
goto out;
--
2.34.1