Re: [PATCH v2 16/30] iommu/omap: implement iova_to_phys_length

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calling `iova_to_phys_length` on an unattached domain causes a NULL pointer dereference.
--

commit 1684c564b3ca8b0ede767819c248c3b62e1635dd
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>

iommu/omap: implement iova_to_phys_length

This commit implements the iova_to_phys_length callback for the OMAP IOMMU
driver. It modifies the existing translation function to also return the
mapped page size.

> diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
> index 8231d7d6bb6a9..883f9f61d4d95 100644
> --- a/drivers/iommu/omap-iommu.c
> +++ b/drivers/iommu/omap-iommu.c
> @@ -1592,15 +1592,19 @@ static void omap_iommu_domain_free(struct iommu_domain *domain)
>  	kfree(omap_domain);
>  }
>  
> -static phys_addr_t omap_iommu_iova_to_phys(struct iommu_domain *domain,
> -					   dma_addr_t da)
> +static phys_addr_t omap_iommu_iova_to_phys_length(struct iommu_domain *domain,
> +						  dma_addr_t da,
> +						  size_t *mapped_length)
>  {
>  	struct omap_iommu_domain *omap_domain = to_omap_domain(domain);
>  	struct omap_iommu_device *iommu = omap_domain->iommus;
>  	struct omap_iommu *oiommu = iommu->iommu_dev;

[Severity: High]
This isn't a bug introduced by this patch, but can this lead to a NULL pointer
dereference if omap_iommu_iova_to_phys_length() is called on an unattached
domain?

When a domain is unattached, omap_domain->iommus is NULL, so setting
iommu = omap_domain->iommus and unconditionally accessing iommu->iommu_dev
would crash the kernel.

It seems possible to trigger this from userspace via iommufd by calling
IOMMU_HWPT_ALLOC with immediate_attach = false. This creates an unattached
domain and adds it to the IOAS.

If subsequent memory access operations trigger pfn_reader_first(), this
could query iova_to_phys_length on all domains within the IOAS, leading
to a local Denial of Service by unprivileged users.

>  	struct device *dev = oiommu->dev;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602104637.1219810-1-guanghuifeng@linux.alibaba.com?part=16