On Tue, Sep 10, 2024 at 05:15:16PM -0400, Matthew Rosato wrote: > This fixes a crash when surprise hot-unplugging a PCI device. This crash > happens because during hot-unplug __iommu_group_set_domain_nofail() > attaching the default domain fails when the platform no longer > recognizes the device as it has already been removed and we end up with > a NULL domain pointer and UAF. This is exactly the case referred to in > the second comment in __iommu_device_set_domain() and just as stated > there if we can instead attach the blocking domain the UAF is prevented > as this can handle the already removed device. Implement the blocking > domain to use this handling. With this change, the crash is fixed but > we still hit a warning attempting to change DMA ownership on a blocked > device. Applied, thanks.
