iommufd: Fix missing update of domains_itree after splitting iopt_area

commit e7250ab7ca4998fe026f2149805b03e09dc32498 upstream.

In iopt_area_split(), if the original iopt_area has filled a domain and is
linked to domains_itree, pages_nodes have to be properly
reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.

Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping")
Link: https://lore.kernel.org/r/20231027162941.2864615-2-den@valinux.co.jp
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
index a4da181..117a39a 100644 (file)
--- a/drivers/iommu/iommufd/io_pagetable.c
+++ b/drivers/iommu/iommufd/io_pagetable.c
@@ -1060,6 +1060,16 @@ static int iopt_area_split(struct iopt_area *area, unsigned long iova)
        if (WARN_ON(rc))
                goto err_remove_lhs;
 
+       /*
+        * If the original area has filled a domain, domains_itree has to be
+        * updated.
+        */
+       if (area->storage_domain) {
+               interval_tree_remove(&area->pages_node, &pages->domains_itree);
+               interval_tree_insert(&lhs->pages_node, &pages->domains_itree);
+               interval_tree_insert(&rhs->pages_node, &pages->domains_itree);
+       }
+
        lhs->storage_domain = area->storage_domain;
        lhs->pages = area->pages;
        rhs->storage_domain = area->storage_domain;