* [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function
@ 2026-06-01 12:12 lirongqing
2026-06-02 4:48 ` Ankit Soni
2026-07-22 21:39 ` Will Deacon
0 siblings, 2 replies; 4+ messages in thread
From: lirongqing @ 2026-06-01 12:12 UTC (permalink / raw)
To: Joerg Roedel, Suravee Suthikulpanit, Will Deacon, Robin Murphy,
iommu, linux-kernel
Cc: Li RongQing
From: Li RongQing <lirongqing@baidu.com>
When for_each_pci_segment() loop completes without finding a matching
segment, the pci_seg pointer is not NULL but points to an invalid memory
location (the list head). Accessing pci_seg->id after the loop causes
undefined behavior.
Fix this by handling the successful case inside the loop and returning
-EINVAL after the loop if no matching segment is found.
Fixes: 2e98940f123d9 ("iommu/amd: Add support for device id user input")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
drivers/iommu/amd/debugfs.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c
index 4c53b63..5c573ec 100644
--- a/drivers/iommu/amd/debugfs.c
+++ b/drivers/iommu/amd/debugfs.c
@@ -176,19 +176,13 @@ static ssize_t devid_write(struct file *filp, const char __user *ubuf,
kfree(srcid_ptr);
return -ENODEV;
}
- break;
- }
-
- if (pci_seg->id != seg) {
+ sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid);
kfree(srcid_ptr);
- return -EINVAL;
+ return cnt;
}
- sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid);
-
kfree(srcid_ptr);
-
- return cnt;
+ return -EINVAL;
}
static int devid_show(struct seq_file *m, void *unused)
--
2.9.4
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function
2026-06-01 12:12 [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function lirongqing
@ 2026-06-02 4:48 ` Ankit Soni
2026-07-21 12:24 ` 答复: [????] " Li,Rongqing
2026-07-22 21:39 ` Will Deacon
1 sibling, 1 reply; 4+ messages in thread
From: Ankit Soni @ 2026-06-02 4:48 UTC (permalink / raw)
To: lirongqing
Cc: Joerg Roedel, Suravee Suthikulpanit, Will Deacon, Robin Murphy,
iommu, linux-kernel
On Mon, Jun 01, 2026 at 08:12:40AM -0400, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
>
> When for_each_pci_segment() loop completes without finding a matching
> segment, the pci_seg pointer is not NULL but points to an invalid memory
> location (the list head). Accessing pci_seg->id after the loop causes
> undefined behavior.
>
> Fix this by handling the successful case inside the loop and returning
> -EINVAL after the loop if no matching segment is found.
>
> Fixes: 2e98940f123d9 ("iommu/amd: Add support for device id user input")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
Hi,
Thanks for the fix. Looks good to me.
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
> ---
> drivers/iommu/amd/debugfs.c | 12 +++---------
> 1 file changed, 3 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c
> index 4c53b63..5c573ec 100644
> --- a/drivers/iommu/amd/debugfs.c
> +++ b/drivers/iommu/amd/debugfs.c
> @@ -176,19 +176,13 @@ static ssize_t devid_write(struct file *filp, const char __user *ubuf,
> kfree(srcid_ptr);
> return -ENODEV;
> }
> - break;
> - }
> -
> - if (pci_seg->id != seg) {
> + sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid);
> kfree(srcid_ptr);
> - return -EINVAL;
> + return cnt;
> }
>
> - sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid);
> -
> kfree(srcid_ptr);
> -
> - return cnt;
> + return -EINVAL;
> }
>
> static int devid_show(struct seq_file *m, void *unused)
> --
> 2.9.4
>
^ permalink raw reply [flat|nested] 4+ messages in thread* 答复: [????] Re: [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function
2026-06-02 4:48 ` Ankit Soni
@ 2026-07-21 12:24 ` Li,Rongqing
0 siblings, 0 replies; 4+ messages in thread
From: Li,Rongqing @ 2026-07-21 12:24 UTC (permalink / raw)
To: Ankit Soni
Cc: Joerg Roedel, Suravee Suthikulpanit, Will Deacon, Robin Murphy,
iommu@lists.linux.dev, linux-kernel@vger.kernel.org
>
> On Mon, Jun 01, 2026 at 08:12:40AM -0400, lirongqing wrote:
> > From: Li RongQing <lirongqing@baidu.com>
> >
> > When for_each_pci_segment() loop completes without finding a matching
> > segment, the pci_seg pointer is not NULL but points to an invalid
> > memory location (the list head). Accessing pci_seg->id after the loop
> > causes undefined behavior.
> >
> > Fix this by handling the successful case inside the loop and returning
> > -EINVAL after the loop if no matching segment is found.
> >
> > Fixes: 2e98940f123d9 ("iommu/amd: Add support for device id user
> > input")
> > Signed-off-by: Li RongQing <lirongqing@baidu.com>
>
> Hi,
>
> Thanks for the fix. Looks good to me.
>
> Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
>
Ping
[Li,Rongqing]
> > ---
> > drivers/iommu/amd/debugfs.c | 12 +++---------
> > 1 file changed, 3 insertions(+), 9 deletions(-)
> >
> > diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c
> > index 4c53b63..5c573ec 100644
> > --- a/drivers/iommu/amd/debugfs.c
> > +++ b/drivers/iommu/amd/debugfs.c
> > @@ -176,19 +176,13 @@ static ssize_t devid_write(struct file *filp, const
> char __user *ubuf,
> > kfree(srcid_ptr);
> > return -ENODEV;
> > }
> > - break;
> > - }
> > -
> > - if (pci_seg->id != seg) {
> > + sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid);
> > kfree(srcid_ptr);
> > - return -EINVAL;
> > + return cnt;
> > }
> >
> > - sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid);
> > -
> > kfree(srcid_ptr);
> > -
> > - return cnt;
> > + return -EINVAL;
> > }
> >
> > static int devid_show(struct seq_file *m, void *unused)
> > --
> > 2.9.4
> >
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function
2026-06-01 12:12 [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function lirongqing
2026-06-02 4:48 ` Ankit Soni
@ 2026-07-22 21:39 ` Will Deacon
1 sibling, 0 replies; 4+ messages in thread
From: Will Deacon @ 2026-07-22 21:39 UTC (permalink / raw)
To: Joerg Roedel, Suravee Suthikulpanit, Robin Murphy, iommu,
linux-kernel, lirongqing
Cc: catalin.marinas, kernel-team, Will Deacon
On Mon, 01 Jun 2026 08:12:40 -0400, lirongqing wrote:
> When for_each_pci_segment() loop completes without finding a matching
> segment, the pci_seg pointer is not NULL but points to an invalid memory
> location (the list head). Accessing pci_seg->id after the loop causes
> undefined behavior.
>
> Fix this by handling the successful case inside the loop and returning
> -EINVAL after the loop if no matching segment is found.
>
> [...]
Applied to iommu (amd/amd-vi), thanks!
[1/1] iommu/amd: Fix undefined behavior in devid_write debugfs function
https://git.kernel.org/iommu/c/843e14998966
Cheers,
--
Will
https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-22 21:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-01 12:12 [PATCH] iommu/amd: Fix undefined behavior in devid_write debugfs function lirongqing
2026-06-02 4:48 ` Ankit Soni
2026-07-21 12:24 ` 答复: [????] " Li,Rongqing
2026-07-22 21:39 ` Will Deacon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox