linux-stable/drivers/iommu
Thomas Gleixner 03992c88d7 irqdomain/treewide: Keep firmware node unconditionally allocated
[ Upstream commit e3beca48a4 ]

Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type
IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after
creating the irqdomain. The only purpose of these FW nodes is to convey
name information. When this was introduced the core code did not store the
pointer to the node in the irqdomain. A recent change stored the firmware
node pointer in irqdomain for other reasons and missed to notice that the
usage sites which do the alloc_fwnode/create_domain/free_fwnode sequence
are broken by this. Storing a dangling pointer is dangerous itself, but in
case that the domain is destroyed later on this leads to a double free.

Remove the freeing of the firmware node after creating the irqdomain from
all affected call sites to cure this.

Fixes: 711419e504 ("irqdomain: Add the missing assignment of domain->fwnode for named fwnode")
Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/873661qakd.fsf@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-29 07:42:52 +02:00
..
amd_iommu.c irqdomain/treewide: Keep firmware node unconditionally allocated 2020-07-29 07:42:52 +02:00
amd_iommu_init.c iommu/amd: Fix over-read of ACPI UID from IVRS table 2020-05-27 16:42:52 +02:00
amd_iommu_proto.h
amd_iommu_types.h iommu/amd: Fix the configuration of GCR3 table root pointer 2020-04-24 08:01:22 +02:00
amd_iommu_v2.c
arm-smmu-regs.h
arm-smmu-v3.c iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE 2020-02-28 16:36:04 +01:00
arm-smmu.c
dma-iommu.c iommu/dma: Fix MSI reservation allocation 2020-03-20 10:54:18 +01:00
dmar.c iommu/vt-d: Ignore devices with out-of-spec domain number 2020-03-20 10:54:19 +01:00
exynos-iommu.c
fsl_pamu.c
fsl_pamu.h
fsl_pamu_domain.c
fsl_pamu_domain.h
intel-iommu.c iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page 2020-03-20 10:54:18 +01:00
intel-svm.c iommu/vt-d: Fix mm reference leak 2020-04-24 08:01:21 +02:00
intel_irq_remapping.c irqdomain/treewide: Keep firmware node unconditionally allocated 2020-07-29 07:42:52 +02:00
io-pgtable-arm-v7s.c
io-pgtable-arm.c iommu/io-pgtable-arm: Fix race handling in split_blk_unmap() 2019-11-24 08:22:52 +01:00
io-pgtable.c
io-pgtable.h
iommu-sysfs.c
iommu-traces.c
iommu.c iommu: Fix reference count leak in iommu_group_alloc. 2020-06-03 08:18:03 +02:00
iova.c iommu/iova: Avoid false sharing on fq_timer_on 2019-10-05 12:47:58 +02:00
ipmmu-vmsa.c
irq_remapping.c
irq_remapping.h
Kconfig
Makefile
msm_iommu.c
msm_iommu.h
msm_iommu_hw-8xxx.h
mtk_iommu.c iommu/mediatek: Fix iova_to_phys PA start for 4GB mode 2020-01-27 14:46:44 +01:00
mtk_iommu.h
mtk_iommu_v1.c
of_iommu.c
omap-iommu-debug.c
omap-iommu.c
omap-iommu.h
omap-iopgtable.h
qcom_iommu.c iommu/qcom: Fix local_base status check 2020-05-05 19:15:51 +02:00
rockchip-iommu.c
s390-iommu.c
tegra-gart.c
tegra-smmu.c iommu/tegra-smmu: Fix page tables in > 4 GiB memory 2020-01-04 13:59:36 +01:00