From: Karl Mehltretter <kmehltretter@gmail.com> mainline inclusion from mainline-v7.3-rc3 commit 00a7dd64888d6dd72110b40e2824a088cf7b7386 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19847 CVE: CVE-2026-98003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume. iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline. Return early if both buffers are already allocated. Clear the pointers in free_ga_log() so a partial allocation failure cannot leave ga_log dangling. Fixes: c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Conflicts: drivers/iommu/amd/init.c [Upstream now uses iommu_alloc_pages_node_sz()/iommu_free_pages() (commit 1e0c8d6b69521 and follow-ups) and WARN_ON_ONCE() for the VAPIC check; this tree predates them, so keep the local __get_free_pages()/free_pages() helpers and the legacy silent !AMD_IOMMU_GUEST_IR_VAPIC() check. Only the early-return guard and the pointer NULLing after free are applied.] Co-authored-by: BackportAgent@GLM-5.3 Signed-off-by: Hulk Robot <hulkrobot@huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20@huawei.com> --- drivers/iommu/amd/init.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index f57e2a784da4..ff36f3c456fa 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -890,7 +890,9 @@ static void free_ga_log(struct amd_iommu *iommu) { #ifdef CONFIG_IRQ_REMAP iommu_free_pages(iommu->ga_log, get_order(GA_LOG_SIZE)); + iommu->ga_log = NULL; iommu_free_pages(iommu->ga_log_tail, get_order(8)); + iommu->ga_log_tail = NULL; #endif } @@ -935,6 +937,9 @@ static int iommu_init_ga_log(struct amd_iommu *iommu) if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir)) return 0; + if (iommu->ga_log && iommu->ga_log_tail) + return 0; + iommu->ga_log = iommu_alloc_pages(GFP_KERNEL, get_order(GA_LOG_SIZE)); if (!iommu->ga_log) goto err_out; -- 2.22.0