commit 85b6d2b5fc25c9c0d10d493b3728183ab8f8e68a
author Alex Williamson <alex.williamson@redhat.com> Thu Sep 15 11:18:27 2022 -0600
committer Alex Williamson <alex.williamson@redhat.com> Tue Sep 27 14:26:42 2022 -0600
tree 92d0ed146522562487624070453430238fc711b5
parent 429c72800654503e0073906f63fdc9a641639bdc

vfio/common: Fix vfio_iommu_type1_info use after free

On error, vfio_get_iommu_info() frees and clears *info, but
vfio_connect_container() continues to use the pointer regardless
of the return value.  Restructure the code such that a failure
of this function triggers an error and clean up the remainder of
the function, including updating an outdated comment that had
drifted from its relevant line of code and using host page size
for a default for better compatibility on non-4KB systems.

Reported-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://lore.kernel.org/all/20220910004245.2878-1-nicolinc@nvidia.com/
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://lore.kernel.org/r/166326219630.3388898.12882473157184946072.stgit@omen
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>