[PATCH Trivial] intel-iommu: check return value of device_to_iommu() before using it

[PATCH Trivial] intel-iommu: check return value of device_to_iommu() before using it

[ethan zhao]

[-- Attachment #1: Type: text/plain, Size: 794 bytes --]

in function iommu_support_dev_iotlb(),return value of device_to_iommu()
is used without checking, this could cause NULL pointer issue.

this patch is for v3.12.6

Signed-off-by: Ethan Zhao <ethan.zhao@oracle.com>
---
  drivers/iommu/intel-iommu.c |    2 ++
  1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 40203ad..5b4531a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1105,6 +1105,8 @@ static struct device_domain_info 
*iommu_support_dev_iotlb(
      struct device_domain_info *info;
      struct intel_iommu *iommu = device_to_iommu(segment, bus, devfn);

+    if (!iommu)
+        return NULL;
      if (!ecap_dev_iotlb_support(iommu->ecap))
          return NULL;

-- 
1.7.1


[-- Attachment #2: 0001-intel-iommu-check-return-value-of-device_to_iommu-be.patch --]
[-- Type: text/x-patch, Size: 1002 bytes --]

>From 27d8cdd3fcc6f4ff5cc2ba36d8d5ea0a97823a17 Mon Sep 17 00:00:00 2001
From: ethan.zhao <ethan.zhao@oracle.com>
Date: Thu, 9 Jan 2014 08:40:16 -0500
Subject: [PATCH] intel-iommu: check return value of device_to_iommu() before using it

in function iommu_support_dev_iotlb(),return value of device_to_iommu()
is used without checking, this could cause NULL pointer issue.

this patch is for v3.12.6

Signed-off-by: Ethan Zhao <ethan.zhao@oracle.com>
---
 drivers/iommu/intel-iommu.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 40203ad..5b4531a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1105,6 +1105,8 @@ static struct device_domain_info *iommu_support_dev_iotlb(
 	struct device_domain_info *info;
 	struct intel_iommu *iommu = device_to_iommu(segment, bus, devfn);
 
+	if (!iommu)
+		return NULL;
 	if (!ecap_dev_iotlb_support(iommu->ecap))
 		return NULL;
 
-- 
1.7.1

Re: [PATCH Trivial] intel-iommu: check return value of device_to_iommu() before using it

[Joerg Roedel]

On Thu, Jan 09, 2014 at 09:58:42AM +0800, ethan zhao wrote:
>  drivers/iommu/intel-iommu.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
> index 40203ad..5b4531a 100644
> --- a/drivers/iommu/intel-iommu.c
> +++ b/drivers/iommu/intel-iommu.c
> @@ -1105,6 +1105,8 @@ static struct device_domain_info
> *iommu_support_dev_iotlb(
>      struct device_domain_info *info;
>      struct intel_iommu *iommu = device_to_iommu(segment, bus, devfn);
> 
> +    if (!iommu)
> +        return NULL;
>      if (!ecap_dev_iotlb_support(iommu->ecap))
>          return NULL;

This call can not fail, iommu_support_dev_iotlb() is only called from
domain_context_mapping_one() which does the iommu==NULL check on its
own before the call.


	Joerg

Re: [PATCH Trivial] intel-iommu: check return value of device_to_iommu() before using it

[Joerg Roedel]

On Thu, Jan 09, 2014 at 09:58:42AM +0800, ethan zhao wrote:
>  drivers/iommu/intel-iommu.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
> index 40203ad..5b4531a 100644
> --- a/drivers/iommu/intel-iommu.c
> +++ b/drivers/iommu/intel-iommu.c
> @@ -1105,6 +1105,8 @@ static struct device_domain_info
> *iommu_support_dev_iotlb(
>      struct device_domain_info *info;
>      struct intel_iommu *iommu = device_to_iommu(segment, bus, devfn);
> 
> +    if (!iommu)
> +        return NULL;
>      if (!ecap_dev_iotlb_support(iommu->ecap))
>          return NULL;

This call can not fail, iommu_support_dev_iotlb() is only called from
domain_context_mapping_one() which does the iommu==NULL check on its
own before the call.


	Joerg

Re: [PATCH Trivial] intel-iommu: check return value of device_to_iommu() before using it

[Ethan Zhao]

On Thu, Jan 9, 2014 at 8:01 PM, Joerg Roedel <joro@8bytes.org> wrote:
> On Thu, Jan 09, 2014 at 09:58:42AM +0800, ethan zhao wrote:
>>  drivers/iommu/intel-iommu.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
>> index 40203ad..5b4531a 100644
>> --- a/drivers/iommu/intel-iommu.c
>> +++ b/drivers/iommu/intel-iommu.c
>> @@ -1105,6 +1105,8 @@ static struct device_domain_info
>> *iommu_support_dev_iotlb(
>>      struct device_domain_info *info;
>>      struct intel_iommu *iommu = device_to_iommu(segment, bus, devfn);
>>
>> +    if (!iommu)
>> +        return NULL;
>>      if (!ecap_dev_iotlb_support(iommu->ecap))
>>          return NULL;
>
> This call can not fail, iommu_support_dev_iotlb() is only called from
> domain_context_mapping_one() which does the iommu==NULL check on its
> own before the call.
>
Agree, till now, was checked in domain_context_mapping_one(), but how
about if we query information with iommu_support_dev_iotlb() in other
code ?

Thanks,
Ethan
>
>         Joerg
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-pci" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html