Patch "vhost-vdpa: free iommu domain after last use during cleanup" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    vhost-vdpa: free iommu domain after last use during cleanup

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vhost-vdpa-free-iommu-domain-after-last-use-during-c.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fa683ec76b89cbfaa285311509a627b6f7253b4f
Author: Gautam Dawar <gautam.dawar@xxxxxxx>
Date:   Wed Mar 1 22:02:01 2023 +0530

    vhost-vdpa: free iommu domain after last use during cleanup
    
    [ Upstream commit 5a522150093a0eabae9470a70a37a6e436bfad08 ]
    
    Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
    `iommu_unmap(v->domain, map->start, map->size);`
    from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
    provide DMA config operations.
    
    However, the IOMMU domain referred to by `v->domain` is freed in
    vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
    vhost_vdpa_release() which results in NULL pointer de-reference.
    Accordingly, moving the call to vhost_vdpa_free_domain() in
    vhost_vdpa_cleanup() would makes sense. This will also help
    detaching the dma device in error handling of vhost_vdpa_alloc_domain().
    
    This issue was observed on terminating QEMU with SIGQUIT.
    
    Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
    Signed-off-by: Gautam Dawar <gautam.dawar@xxxxxxx>
    Message-Id: <20230301163203.29883-1-gautam.dawar@xxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
    Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index ec32f785dfdec..b7657984dd8df 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v)
 
 err_attach:
 	iommu_domain_free(v->domain);
+	v->domain = NULL;
 	return ret;
 }
 
@@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v)
 			vhost_vdpa_remove_as(v, asid);
 	}
 
+	vhost_vdpa_free_domain(v);
 	vhost_dev_cleanup(&v->vdev);
 	kfree(v->vdev.vqs);
 }
@@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)
 	vhost_vdpa_clean_irq(v);
 	vhost_vdpa_reset(v);
 	vhost_dev_stop(&v->vdev);
-	vhost_vdpa_free_domain(v);
 	vhost_vdpa_config_put(v);
 	vhost_vdpa_cleanup(v);
 	mutex_unlock(&d->mutex);