4.4-stable patches

added patches:
	iommu-arm-smmu-v3-don-t-free-page-table-ops-twice.patch

diff --git a/queue-4.4/iommu-arm-smmu-v3-don-t-free-page-table-ops-twice.patch b/queue-4.4/iommu-arm-smmu-v3-don-t-free-page-table-ops-twice.patch
new file mode 100644 (file)
index 0000000..9c3d2d1
--- /dev/null
+++ b/queue-4.4/iommu-arm-smmu-v3-don-t-free-page-table-ops-twice.patch
@@ -0,0 +1,44 @@
+From 57d72e159b60456c8bb281736c02ddd3164037aa Mon Sep 17 00:00:00 2001
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Date: Thu, 14 Dec 2017 11:03:01 +0000
+Subject: iommu/arm-smmu-v3: Don't free page table ops twice
+
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+
+commit 57d72e159b60456c8bb281736c02ddd3164037aa upstream.
+
+Kasan reports a double free when finalise_stage_fn fails: the io_pgtable
+ops are freed by arm_smmu_domain_finalise and then again by
+arm_smmu_domain_free. Prevent this by leaving pgtbl_ops empty on failure.
+
+Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices")
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/arm-smmu-v3.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1541,13 +1541,15 @@ static int arm_smmu_domain_finalise(stru
+               return -ENOMEM;
+ 
+       arm_smmu_ops.pgsize_bitmap = pgtbl_cfg.pgsize_bitmap;
+-      smmu_domain->pgtbl_ops = pgtbl_ops;
+ 
+       ret = finalise_stage_fn(smmu_domain, &pgtbl_cfg);
+-      if (IS_ERR_VALUE(ret))
++      if (IS_ERR_VALUE(ret)) {
+               free_io_pgtable_ops(pgtbl_ops);
++              return ret;
++      }
+ 
+-      return ret;
++      smmu_domain->pgtbl_ops = pgtbl_ops;
++      return 0;
+ }
+ 
+ static struct arm_smmu_group *arm_smmu_group_get(struct device *dev)

diff --git a/queue-4.4/series b/queue-4.4/series
index 2daddd1d8d3c031dccb4555263be15ce2970621b..1ab6b421ad8e88174830d05f3904226143c44c40 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -13,3 +13,4 @@ net-mac80211-debugfs.c-prevent-build-failure-with-config_ubsan-y.patch
 kvm-vmx-scrub-hardware-gprs-at-vm-exit.patch
 x86-vsdo-fix-build-on-paravirt_clock-y-kvm_guest-n.patch
 x86-acpi-handle-sci-interrupts-above-legacy-space-gracefully.patch
+iommu-arm-smmu-v3-don-t-free-page-table-ops-twice.patch