[PATCH] dmaengine: ioatdma: Fix NULL pointer dereference in ioat_alloc_chan_resources()

[PATCH] dmaengine: ioatdma: Fix NULL pointer dereference in ioat_alloc_chan_resources()

[Yang Zi]

ioat_alloc_chan_resources() performs MMIO accesses using
ioat_chan->reg_base without validating that the device's BAR mapping
(ioat_chan->ioat_dma->reg_base) is valid.  If the PCI BAR is not
properly mapped, reg_base is NULL and the channel's reg_base is computed
as NULL plus a small channel offset, so the first writew() touches an
address near NULL and faults.

KASAN/Oops report:

    BUG: kernel NULL pointer dereference, address: 0000000000000181
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0002) - not-present page
    RIP: 0010:ioat_alloc_chan_resources+0x40b/0x1ff0 [drivers/dma/ioat/init.c:679]

Validate the MMIO base before any register access and return -ENODEV if
it is not mapped.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
 drivers/dma/ioat/init.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 737496391109..80dc8f36c346 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -677,6 +677,10 @@ static int ioat_alloc_chan_resources(struct dma_chan *c)
     if (ioat_chan->ring)
         return 1 << ioat_chan->alloc_order;
 
+    /* Validate the MMIO base before any register access. */
+    if (!ioat_chan->ioat_dma->reg_base)
+        return -ENODEV;
+
     /* Setup register to interrupt and write completion status on error */
     writew(IOAT_CHANCTRL_RUN, ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);
 

Re: [PATCH] dmaengine: ioatdma: Fix NULL pointer dereference in ioat_alloc_chan_resources()

[Dave Jiang]

On 8/25/26 2:14 AM, Yang Zi wrote:
> ioat_alloc_chan_resources() performs MMIO accesses using
> ioat_chan->reg_base without validating that the device's BAR mapping
> (ioat_chan->ioat_dma->reg_base) is valid.  If the PCI BAR is not
> properly mapped, reg_base is NULL and the channel's reg_base is computed
> as NULL plus a small channel offset, so the first writew() touches an
> address near NULL and faults.
> 
> KASAN/Oops report:
> 
>     BUG: kernel NULL pointer dereference, address: 0000000000000181
>     #PF: supervisor write access in kernel mode
>     #PF: error_code(0x0002) - not-present page
>     RIP: 0010:ioat_alloc_chan_resources+0x40b/0x1ff0 [drivers/dma/ioat/init.c:679]
> 
> Validate the MMIO base before any register access and return -ENODEV if
> it is not mapped.
> 
> Signed-off-by: Yang Zi <2959243019@qq.com>

NAK. This not reachable code. By the time ioat_alloc_chan_resources() gets called, reg_base would never be NULL. If iomap has failed, it would've failed long before this. The pci probe would've failed and the driver would not have loaded.

DJ


> ---
>  drivers/dma/ioat/init.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
> index 737496391109..80dc8f36c346 100644
> --- a/drivers/dma/ioat/init.c
> +++ b/drivers/dma/ioat/init.c
> @@ -677,6 +677,10 @@ static int ioat_alloc_chan_resources(struct dma_chan *c)
>      if (ioat_chan->ring)
>          return 1 << ioat_chan->alloc_order;
>  
> +    /* Validate the MMIO base before any register access. */
> +    if (!ioat_chan->ioat_dma->reg_base)
> +        return -ENODEV;
> +
>      /* Setup register to interrupt and write completion status on error */
>      writew(IOAT_CHANCTRL_RUN, ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);
>  
>