d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vmm: fix use after free in ppt_detach()

Browse Source 
The vmm module destroys the host_domain before unloading the ppt module
causing a use after free. This can happen when kldunload'ing vmm.

Reviewed by:	markj, jhb
Differential Revision:	https://reviews.freebsd.org/D38072
This commit is contained in:
Robert Wing 2023-01-20 11:25:27 +00:00
parent c668e8173a
commit 27029bc08f
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/amd64/vmm/intel/vtd.c
View File

@ -446,6 +446,8 @@ vtd_add_device(void *arg, uint16_t rid)
struct vtdmap *vtdmap;
uint8_t bus;
KASSERT(dom != NULL, ("domain is NULL"));
bus = PCI_RID2BUS(rid);
ctxp = ctx_tables[bus];
pt_paddr = vtophys(dom->ptp);

1
sys/amd64/vmm/io/iommu.c
View File

@ -258,6 +258,7 @@ iommu_cleanup(void)
}
IOMMU_DISABLE();
IOMMU_DESTROY_DOMAIN(host_domain);
host_domain = NULL;
IOMMU_CLEANUP();
}

4
sys/amd64/vmm/io/ppt.c
View File

@ -182,7 +182,9 @@ ppt_detach(device_t dev)
num_pptdevs--;
TAILQ_REMOVE(&pptdev_list, ppt, next);
pci_disable_busmaster(dev);
iommu_add_device(iommu_host_domain(), pci_get_rid(dev));
if (iommu_host_domain() != NULL)
iommu_add_device(iommu_host_domain(), pci_get_rid(dev));
return (0);
}