Re: [PATCH v2 05/30] iommu/generic_pt: implement iova_to_phys_length

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing .iova_to_phys in IOMMU_PT_DOMAIN_OPS leads to NULL pointer dereference in iommufd selftests.
--

commit e2c842a298a80551337d0eb21cf64d10984cc30d
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>

iommu/generic_pt: implement iova_to_phys_length

Extend the Generic Page Table framework to implement iova_to_phys_length.
Update the IOMMU_PT_DOMAIN_OPS macro to set .iova_to_phys_length instead
of .iova_to_phys.

> diff --git a/include/linux/generic_pt/iommu.h b/include/linux/generic_pt/iommu.h
> index dd0edd02a48a2..859b853e9dc7e 100644
> --- a/include/linux/generic_pt/iommu.h
> +++ b/include/linux/generic_pt/iommu.h
[ ... ]
> @@ -267,11 +268,11 @@ struct pt_iommu_cfg {
>  	IOMMU_PROTOTYPES(fmt)
>  
>  /*
> - * A driver uses IOMMU_PT_DOMAIN_OPS to populate the iommu_domain_ops for the
> - * iommu_pt
> + * A driver uses IOMMU_PT_DOMAIN_OPS to populate the iommu_domain_ops for
> + * the iommu_pt
>   */
> -#define IOMMU_PT_DOMAIN_OPS(fmt)                        \
> -	.iova_to_phys = &pt_iommu_##fmt##_iova_to_phys
> +#define IOMMU_PT_DOMAIN_OPS(fmt)					\
> +	.iova_to_phys_length = &pt_iommu_##fmt##_iova_to_phys_length

[Severity: Medium]
Will this macro change cause a NULL pointer dereference in the iommufd
selftests?

Looking at iommufd_test_md_check_pa() in drivers/iommu/iommufd/selftest.c,
it bypasses the safe iommu_iova_to_phys() wrapper and calls the op directly
without checking for NULL:

drivers/iommu/iommufd/selftest.c:iommufd_test_md_check_pa() {
    ...
    io_phys = mock->domain.ops->iova_to_phys(&mock->domain, iova);
    ...
}

Because mock domains in the selftests are initialized using this macro,
their .iova_to_phys function pointer will now be NULL, which causes a crash
when the selftest executes.

I see this issue is fixed later in the series by commit cb17e198ab7d
"vfio/iommufd: use iova_to_phys_length for efficient unmap", but does this
intermediate commit break the build's selftests during bisection?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602104637.1219810-1-guanghuifeng@linux.alibaba.com?part=5