* [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
@ 2026-08-18 19:13 Niklas Schnelle
2026-08-18 20:00 ` Farhan Ali
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Niklas Schnelle @ 2026-08-18 19:13 UTC (permalink / raw)
To: Matthew Rosato, Farhan Ali, Omar Elghoul, Gerd Bayer,
Benjamin Block, Julian Ruess, Joerg Roedel (AMD), Will Deacon,
Robin Murphy, Joerg Roedel
Cc: Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Sven Schnelle,
Ramesh Errabolu, Tobias Schumacher, Halil Pasic,
Peter Oberparleiter, Gerald Schaefer, Christian Borntraeger,
Niklas Schnelle, linux-s390, iommu, linux-kernel
When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
get_rso_from_iova() returns NULL when the region-first entry is invalid.
Yet in get_rto_from_iova() the region-second origin rso is not checked
to be non-NULL before accessing rso[rsx] leading to a NULL pointer
dereference instead of a NULL return when iova_to_phys() is called on
a unmapped IOVA. Fix this by adding the missing NULL check.
Cc: stable@vger.kernel.org
Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
---
drivers/iommu/s390-iommu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c
index f148f559ac56..58ca7727b7f2 100644
--- a/drivers/iommu/s390-iommu.c
+++ b/drivers/iommu/s390-iommu.c
@@ -974,6 +974,8 @@ static unsigned long *get_rto_from_iova(struct s390_domain *domain,
case ZPCI_TABLE_TYPE_RFX:
case ZPCI_TABLE_TYPE_RSX:
rso = get_rso_from_iova(domain, iova);
+ if (!rso)
+ return NULL;
rsx = calc_rsx(iova);
rse = READ_ONCE(rso[rsx]);
if (!reg_entry_isvalid(rse))
---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260818-iommu_fix_iova_to_phys-5879275b95ec
Best regards,
--
Niklas Schnelle
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
2026-08-18 19:13 [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX Niklas Schnelle
@ 2026-08-18 20:00 ` Farhan Ali
2026-08-18 20:16 ` Matthew Rosato
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Farhan Ali @ 2026-08-18 20:00 UTC (permalink / raw)
To: Niklas Schnelle, Matthew Rosato, Omar Elghoul, Gerd Bayer,
Benjamin Block, Julian Ruess, Joerg Roedel (AMD), Will Deacon,
Robin Murphy, Joerg Roedel
Cc: Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Sven Schnelle,
Ramesh Errabolu, Tobias Schumacher, Halil Pasic,
Peter Oberparleiter, Gerald Schaefer, Christian Borntraeger,
linux-s390, iommu, linux-kernel
On 8/18/2026 12:13 PM, Niklas Schnelle wrote:
> When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
> get_rso_from_iova() returns NULL when the region-first entry is invalid.
> Yet in get_rto_from_iova() the region-second origin rso is not checked
> to be non-NULL before accessing rso[rsx] leading to a NULL pointer
> dereference instead of a NULL return when iova_to_phys() is called on
> a unmapped IOVA. Fix this by adding the missing NULL check.
>
> Cc:stable@vger.kernel.org
> Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
> Signed-off-by: Niklas Schnelle<schnelle@linux.ibm.com>
> ---
> drivers/iommu/s390-iommu.c | 2 ++
> 1 file changed, 2 insertions(+)
Reviewed-by: Farhan Ali<alifm@linux.ibm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
2026-08-18 19:13 [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX Niklas Schnelle
2026-08-18 20:00 ` Farhan Ali
@ 2026-08-18 20:16 ` Matthew Rosato
2026-08-21 12:39 ` Benjamin Block
2026-08-23 21:00 ` Vasily Gorbik
3 siblings, 0 replies; 6+ messages in thread
From: Matthew Rosato @ 2026-08-18 20:16 UTC (permalink / raw)
To: Niklas Schnelle, Farhan Ali, Omar Elghoul, Gerd Bayer,
Benjamin Block, Julian Ruess, Joerg Roedel (AMD), Will Deacon,
Robin Murphy, Joerg Roedel
Cc: Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Sven Schnelle,
Ramesh Errabolu, Tobias Schumacher, Halil Pasic,
Peter Oberparleiter, Gerald Schaefer, Christian Borntraeger,
linux-s390, iommu, linux-kernel
On 8/18/26 3:13 PM, Niklas Schnelle wrote:
> When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
> get_rso_from_iova() returns NULL when the region-first entry is invalid.
> Yet in get_rto_from_iova() the region-second origin rso is not checked
> to be non-NULL before accessing rso[rsx] leading to a NULL pointer
> dereference instead of a NULL return when iova_to_phys() is called on
> a unmapped IOVA. Fix this by adding the missing NULL check.
>
> Cc: stable@vger.kernel.org
> Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
> ---
> drivers/iommu/s390-iommu.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c
> index f148f559ac56..58ca7727b7f2 100644
> --- a/drivers/iommu/s390-iommu.c
> +++ b/drivers/iommu/s390-iommu.c
> @@ -974,6 +974,8 @@ static unsigned long *get_rto_from_iova(struct s390_domain *domain,
> case ZPCI_TABLE_TYPE_RFX:
> case ZPCI_TABLE_TYPE_RSX:
> rso = get_rso_from_iova(domain, iova);
> + if (!rso)
> + return NULL;
> rsx = calc_rsx(iova);
> rse = READ_ONCE(rso[rsx]);
> if (!reg_entry_isvalid(rse))
>
> ---
> base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
> change-id: 20260818-iommu_fix_iova_to_phys-5879275b95ec
>
> Best regards,
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
2026-08-18 19:13 [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX Niklas Schnelle
2026-08-18 20:00 ` Farhan Ali
2026-08-18 20:16 ` Matthew Rosato
@ 2026-08-21 12:39 ` Benjamin Block
2026-08-23 21:00 ` Vasily Gorbik
3 siblings, 0 replies; 6+ messages in thread
From: Benjamin Block @ 2026-08-21 12:39 UTC (permalink / raw)
To: Niklas Schnelle
Cc: Matthew Rosato, Farhan Ali, Omar Elghoul, Gerd Bayer,
Julian Ruess, Joerg Roedel (AMD), Will Deacon, Robin Murphy,
Joerg Roedel, Heiko Carstens, Vasily Gorbik, Alexander Gordeev,
Sven Schnelle, Ramesh Errabolu, Tobias Schumacher, Halil Pasic,
Peter Oberparleiter, Gerald Schaefer, Christian Borntraeger,
linux-s390, iommu, linux-kernel
On Tue, Aug 18, 2026 at 09:13:17PM +0200, Niklas Schnelle wrote:
> When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
> get_rso_from_iova() returns NULL when the region-first entry is invalid.
> Yet in get_rto_from_iova() the region-second origin rso is not checked
> to be non-NULL before accessing rso[rsx] leading to a NULL pointer
> dereference instead of a NULL return when iova_to_phys() is called on
> a unmapped IOVA. Fix this by adding the missing NULL check.
>
> Cc: stable@vger.kernel.org
> Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> ---
> drivers/iommu/s390-iommu.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c
> index f148f559ac56..58ca7727b7f2 100644
> --- a/drivers/iommu/s390-iommu.c
> +++ b/drivers/iommu/s390-iommu.c
> @@ -974,6 +974,8 @@ static unsigned long *get_rto_from_iova(struct s390_domain *domain,
> case ZPCI_TABLE_TYPE_RFX:
> case ZPCI_TABLE_TYPE_RSX:
> rso = get_rso_from_iova(domain, iova);
> + if (!rso)
> + return NULL;
> rsx = calc_rsx(iova);
> rse = READ_ONCE(rso[rsx]);
> if (!reg_entry_isvalid(rse))
Looks good to me!
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
--
Best Regards, Benjamin Block / Linux on IBM Z Kernel Development
IBM Deutschland Research & Development GmbH / https://www.ibm.com/privacy
Vors. Aufs.-R.: Wolfgang Wendt / Geschäftsführung: David Faller
Sitz der Ges.: Ehningen / Registergericht: AmtsG Stuttgart, HRB 243294
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
2026-08-18 19:13 [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX Niklas Schnelle
` (2 preceding siblings ...)
2026-08-21 12:39 ` Benjamin Block
@ 2026-08-23 21:00 ` Vasily Gorbik
2026-08-24 7:18 ` Vasily Gorbik
3 siblings, 1 reply; 6+ messages in thread
From: Vasily Gorbik @ 2026-08-23 21:00 UTC (permalink / raw)
To: Niklas Schnelle
Cc: Matthew Rosato, Farhan Ali, Omar Elghoul, Gerd Bayer,
Benjamin Block, Julian Ruess, Joerg Roedel (AMD), Will Deacon,
Robin Murphy, Joerg Roedel, Heiko Carstens, Alexander Gordeev,
Sven Schnelle, Ramesh Errabolu, Tobias Schumacher, Halil Pasic,
Peter Oberparleiter, Gerald Schaefer, Christian Borntraeger,
linux-s390, iommu, linux-kernel
On Tue, Aug 18, 2026 at 09:13:17PM +0200, Niklas Schnelle wrote:
> When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
> get_rso_from_iova() returns NULL when the region-first entry is invalid.
> Yet in get_rto_from_iova() the region-second origin rso is not checked
> to be non-NULL before accessing rso[rsx] leading to a NULL pointer
> dereference instead of a NULL return when iova_to_phys() is called on
> a unmapped IOVA. Fix this by adding the missing NULL check.
>
> Cc: stable@vger.kernel.org
> Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> ---
> drivers/iommu/s390-iommu.c | 2 ++
> 1 file changed, 2 insertions(+)
Applied, thank you!
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
2026-08-23 21:00 ` Vasily Gorbik
@ 2026-08-24 7:18 ` Vasily Gorbik
0 siblings, 0 replies; 6+ messages in thread
From: Vasily Gorbik @ 2026-08-24 7:18 UTC (permalink / raw)
To: Niklas Schnelle
Cc: Matthew Rosato, Farhan Ali, Omar Elghoul, Gerd Bayer,
Benjamin Block, Julian Ruess, Joerg Roedel (AMD), Will Deacon,
Robin Murphy, Joerg Roedel, Heiko Carstens, Alexander Gordeev,
Sven Schnelle, Ramesh Errabolu, Tobias Schumacher, Halil Pasic,
Peter Oberparleiter, Gerald Schaefer, Christian Borntraeger,
linux-s390, iommu, linux-kernel
On Sun, Aug 23, 2026 at 11:00:33PM +0200, Vasily Gorbik wrote:
> On Tue, Aug 18, 2026 at 09:13:17PM +0200, Niklas Schnelle wrote:
> > When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
> > get_rso_from_iova() returns NULL when the region-first entry is invalid.
> > Yet in get_rto_from_iova() the region-second origin rso is not checked
> > to be non-NULL before accessing rso[rsx] leading to a NULL pointer
> > dereference instead of a NULL return when iova_to_phys() is called on
> > a unmapped IOVA. Fix this by adding the missing NULL check.
> >
> > Cc: stable@vger.kernel.org
> > Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
> > Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> > ---
> > drivers/iommu/s390-iommu.c | 2 ++
> > 1 file changed, 2 insertions(+)
>
> Applied, thank you!
Oh, I was too eager here. Please disregard my previous "Applied" message.
This usually goes via IOMMU subsystem tree and not s390 tree.
Joerg, Will, I'll leave this one to you. Sorry for the confusion.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-24 7:18 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-18 19:13 [PATCH] iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX Niklas Schnelle
2026-08-18 20:00 ` Farhan Ali
2026-08-18 20:16 ` Matthew Rosato
2026-08-21 12:39 ` Benjamin Block
2026-08-23 21:00 ` Vasily Gorbik
2026-08-24 7:18 ` Vasily Gorbik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox