From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Williamson Subject: Re: [PATCH 1/2] iommu: Make iommu_group_get_for_dev() more robust Date: Thu, 21 Aug 2014 15:54:17 -0600 Message-ID: <1408658057.2906.20.camel@ul30vt.home> References: <1408657045-4979-1-git-send-email-joro@8bytes.org> <1408657045-4979-2-git-send-email-joro@8bytes.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1408657045-4979-2-git-send-email-joro-zLv9SwRftAIdnm+yROfE0A@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Joerg Roedel Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Joerg Roedel , David Woodhouse , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: iommu@lists.linux-foundation.org On Thu, 2014-08-21 at 23:37 +0200, Joerg Roedel wrote: > From: Joerg Roedel > > When a non-PCI device is passed to that function it might > pass group == NULL to iommu_group_add_device() which then > dereferences it and cause a crash this way. Fix it by > just returning an error for non-PCI devices. > > Fixes: 104a1c13ac66e40cf8c6ae74d76ff14ff24b9b01 > Cc: Alex Williamson > Signed-off-by: Joerg Roedel > --- > drivers/iommu/iommu.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c > index 1698360..ef8da12 100644 > --- a/drivers/iommu/iommu.c > +++ b/drivers/iommu/iommu.c > @@ -678,15 +678,17 @@ static struct iommu_group *iommu_group_get_for_pci_dev(struct pci_dev *pdev) > */ > struct iommu_group *iommu_group_get_for_dev(struct device *dev) > { > - struct iommu_group *group = ERR_PTR(-EIO); > + struct iommu_group *group; > int ret; > > group = iommu_group_get(dev); > if (group) > return group; Hmm, I bet I had a second pointer for this case but mistakenly optimized it out refining the patch. This solution works too though. Acked-by: Alex Williamson Thanks! Alex > > - if (dev_is_pci(dev)) > - group = iommu_group_get_for_pci_dev(to_pci_dev(dev)); > + if (!dev_is_pci(dev)) > + return ERR_PTR(-EINVAL); > + > + group = iommu_group_get_for_pci_dev(to_pci_dev(dev)); > > if (IS_ERR(group)) > return group;