iommufd: Fix missing update of domains_itree after splitting iopt_area
authorKoichiro Den <den@valinux.co.jp>
Fri, 27 Oct 2023 16:29:42 +0000 (01:29 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 28 Nov 2023 17:19:57 +0000 (17:19 +0000)
commitfcb32111f01ddf3cbd04644cde1773428e31de6a
tree0ad476845d7f45991593572a2c12ccff4deddccf
parentdbfbac0f94a113611a8b2016eb126ceeabaa60c5
iommufd: Fix missing update of domains_itree after splitting iopt_area

commit e7250ab7ca4998fe026f2149805b03e09dc32498 upstream.

In iopt_area_split(), if the original iopt_area has filled a domain and is
linked to domains_itree, pages_nodes have to be properly
reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.

Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping")
Link: https://lore.kernel.org/r/20231027162941.2864615-2-den@valinux.co.jp
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/iommu/iommufd/io_pagetable.c