diff options
author | Andrew Cooper <andrew.cooper3@citrix.com> | 2013-10-08 11:06:48 +0200 |
---|---|---|
committer | Jan Beulich <jbeulich@suse.com> | 2013-10-08 11:06:48 +0200 |
commit | 1c240f1bfed56a459a9cde5100b12bfca4275f26 (patch) | |
tree | 6bbda017b86bd83fd346cf5b05cda57f2c4b5f99 /xen | |
parent | 84f04d8f0dbfc24a48ee888011ca7410b7bbafc5 (diff) | |
download | xen-1c240f1bfed56a459a9cde5100b12bfca4275f26.tar.gz xen-1c240f1bfed56a459a9cde5100b12bfca4275f26.tar.bz2 xen-1c240f1bfed56a459a9cde5100b12bfca4275f26.zip |
VT-d: fix suspected data race condition in iommu_set_root_entry()
Coverity ID: 1054967
Coverity spotted that iommu->root_maddr was optionally allocated within the
protection of the iommu->lock, but was referenced with the protection of the
iommu->register_lock, and freed without any lock.
Luckily, the code as-is is not vulnerable to the potential risks identified.
However, the alloc_pgtable_maddr() is far more appropriately done in
iommu_alloc(), removing a set of spinlock calls, and a possibility for the
iommu setup to fail later than iommu_alloc() with an -ENOMEM.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Xiantao Zhang <xiantao.zhang@intel.com>
Diffstat (limited to 'xen')
-rw-r--r-- | xen/drivers/passthrough/vtd/iommu.c | 19 |
1 files changed, 3 insertions, 16 deletions
diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 12e0165665..2dbe97a7d1 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -696,25 +696,9 @@ static void iommu_free_pagetable(u64 pt_maddr, int level) static int iommu_set_root_entry(struct iommu *iommu) { - struct acpi_drhd_unit *drhd; u32 sts; unsigned long flags; - spin_lock(&iommu->lock); - - if ( iommu->root_maddr == 0 ) - { - drhd = iommu_to_drhd(iommu); - iommu->root_maddr = alloc_pgtable_maddr(drhd, 1); - } - - if ( iommu->root_maddr == 0 ) - { - spin_unlock(&iommu->lock); - return -ENOMEM; - } - - spin_unlock(&iommu->lock); spin_lock_irqsave(&iommu->register_lock, flags); dmar_writeq(iommu->reg, DMAR_RTADDR_REG, iommu->root_maddr); @@ -1144,6 +1128,9 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd) iommu->intel->drhd = drhd; drhd->iommu = iommu; + if ( !(iommu->root_maddr = alloc_pgtable_maddr(drhd, 1)) ) + return -ENOMEM; + iommu->reg = ioremap(drhd->address, PAGE_SIZE); if ( !iommu->reg ) return -ENOMEM; |