From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Koos Vriezen <koos.vriezen@gmail.com>,
Joerg Roedel <jroedel@suse.de>
Subject: [PATCH 3.18 099/124] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
Date: Thu, 20 Apr 2017 08:36:14 +0200 [thread overview]
Message-ID: <20170420063600.859357754@linuxfoundation.org> (raw)
In-Reply-To: <20170420063557.021306233@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koos Vriezen <koos.vriezen@gmail.com>
commit 5003ae1e735e6bfe4679d9bed6846274f322e77e upstream.
The function device_to_iommu() in the Intel VT-d driver
lacks a NULL-ptr check, resulting in this oops at boot on
some platforms:
BUG: unable to handle kernel NULL pointer dereference at 00000000000007ab
IP: [<ffffffff8132234a>] device_to_iommu+0x11a/0x1a0
PGD 0
[...]
Call Trace:
? find_or_alloc_domain.constprop.29+0x1a/0x300
? dw_dma_probe+0x561/0x580 [dw_dmac_core]
? __get_valid_domain_for_dev+0x39/0x120
? __intel_map_single+0x138/0x180
? intel_alloc_coherent+0xb6/0x120
? sst_hsw_dsp_init+0x173/0x420 [snd_soc_sst_haswell_pcm]
? mutex_lock+0x9/0x30
? kernfs_add_one+0xdb/0x130
? devres_add+0x19/0x60
? hsw_pcm_dev_probe+0x46/0xd0 [snd_soc_sst_haswell_pcm]
? platform_drv_probe+0x30/0x90
? driver_probe_device+0x1ed/0x2b0
? __driver_attach+0x8f/0xa0
? driver_probe_device+0x2b0/0x2b0
? bus_for_each_dev+0x55/0x90
? bus_add_driver+0x110/0x210
? 0xffffffffa11ea000
? driver_register+0x52/0xc0
? 0xffffffffa11ea000
? do_one_initcall+0x32/0x130
? free_vmap_area_noflush+0x37/0x70
? kmem_cache_alloc+0x88/0xd0
? do_init_module+0x51/0x1c4
? load_module+0x1ee9/0x2430
? show_taint+0x20/0x20
? kernel_read_file+0xfd/0x190
? SyS_finit_module+0xa3/0xb0
? do_syscall_64+0x4a/0xb0
? entry_SYSCALL64_slow_path+0x25/0x25
Code: 78 ff ff ff 4d 85 c0 74 ee 49 8b 5a 10 0f b6 9b e0 00 00 00 41 38 98 e0 00 00 00 77 da 0f b6 eb 49 39 a8 88 00 00 00 72 ce eb 8f <41> f6 82 ab 07 00 00 04 0f 85 76 ff ff ff 0f b6 4d 08 88 0e 49
RIP [<ffffffff8132234a>] device_to_iommu+0x11a/0x1a0
RSP <ffffc90001457a78>
CR2: 00000000000007ab
---[ end trace 16f974b6d58d0aad ]---
Add the missing pointer check.
Fixes: 1c387188c60f53b338c20eee32db055dfe022a9b ("iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions")
Signed-off-by: Koos Vriezen <koos.vriezen@gmail.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -719,7 +719,7 @@ static struct intel_iommu *device_to_iom
* which we used for the IOMMU lookup. Strictly speaking
* we could do this for all PCI devices; we only need to
* get the BDF# from the scope table for ACPI matches. */
- if (pdev->is_virtfn)
+ if (pdev && pdev->is_virtfn)
goto got_pdev;
*bus = drhd->devices[i].bus;
next prev parent reply other threads:[~2017-04-20 6:40 UTC|newest]
Thread overview: 124+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-20 6:34 [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 001/124] CIFS: store results of cifs_reopen_file to avoid infinite wait Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 002/124] Input: xpad - add support for Razer Wildcat gamepad Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 003/124] perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 004/124] x86/vdso: Plug race between mapping and ELF header setup Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 005/124] x86/vdso: Ensure vdso32_enabled gets set to valid values only Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 006/124] iscsi-target: Fix TMR reference leak during session shutdown Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 007/124] iscsi-target: Drop work-around for legacy GlobalSAN initiator Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 008/124] scsi: sr: Sanity check returned mode data Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 009/124] scsi: sd: Fix capacity calculation with 32-bit sector_t Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 010/124] xen, fbfront: fix connecting to backend Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 011/124] ftrace: Fix removing of second function probe Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 012/124] char: Drop bogus dependency of DEVPORT on !M68K Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 013/124] char: lack of bool string made CONFIG_DEVPORT always on Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 014/124] Revert "ARM: 8457/1: psci-smp is built only for SMP" Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 015/124] kvm: fix page struct leak in handle_vmon Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 016/124] drm/vmwgfx: Type-check lookups of fence objects Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 017/124] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 018/124] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 019/124] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 020/124] drm/vmwgfx: Remove getparam error message Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 021/124] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 022/124] c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 023/124] mips/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman
2017-04-20 6:34 ` [PATCH 3.18 024/124] sparc/ptrace: " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 025/124] metag/ptrace: " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 026/124] metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 027/124] metag/ptrace: Reject partial NT_METAG_RPIPE writes Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 028/124] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 029/124] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 030/124] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 031/124] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 032/124] Drivers: hv: balloon: dont crash when memory is added in non-sorted order Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 037/124] ALSA: seq: Fix racy cell insertions during snd_seq_pool_done() Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 038/124] ALSA: seq: Fix race during FIFO resize Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 039/124] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 040/124] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 041/124] powerpc/boot: Fix zImage TOC alignment Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 042/124] target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 043/124] scsi: lpfc: Add shutdown method for kexec Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 044/124] scsi: libiscsi: add lock around task lists to fix list corruption regression Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 045/124] scsi: sg: check length passed to SG_NEXT_CMD_LEN Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 046/124] scsi: libsas: fix ata xfer length Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 047/124] xen/acpi: upload PM state from init-domain to Xen Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 049/124] tty/serial: atmel: fix race condition (TX+DMA) Greg Kroah-Hartman
2017-04-20 7:46 ` Richard Genoud
2017-04-20 13:37 ` Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 050/124] zram: do not use copy_page with non-page aligned address Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 051/124] powerpc: Disable HFSCR[TM] if TM is not supported Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 052/124] crypto: ahash - Fix EINPROGRESS notification callback Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 053/124] [media] dvb-usb-v2: avoid use-after-free Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 055/124] rtc: tegra: Implement clock handling Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 056/124] mm: Tighten x86 /dev/mem with zeroing reads Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 057/124] [media] dvb-usb: dont use stack for firmware load Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 059/124] virtio-console: avoid DMA from stack Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 061/124] rtl8150: Use heap buffers for all register access Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 062/124] catc: Combine failure cleanup code in catc_probe() Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 063/124] catc: Use heap buffer for memory size test Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 065/124] sctp: deny peeloff operation on asocs with threads sleeping on it Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 066/124] net sched actions: decrement module reference count after table flush Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 067/124] KVM: PPC: Book3S PR: Fix illegal opcode emulation Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 069/124] KVM: kvm_io_bus_unregister_dev() should never fail Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 070/124] arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 071/124] perf/core: Fix event inheritance on fork() Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 072/124] md/raid1/10: fix potential deadlock Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 073/124] target: Fix VERIFY_16 handling in sbc_parse_cdb Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 074/124] isdn/gigaset: fix NULL-deref at probe Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 075/124] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 076/124] ipv4: provide stronger user input validation in nl_fib_input() Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 077/124] Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 078/124] Input: iforce - validate number of endpoints before using them Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 079/124] Input: ims-pcu " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 080/124] Input: hanwang " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 081/124] Input: yealink " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 082/124] Input: cm109 " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 083/124] Input: kbtab " Greg Kroah-Hartman
2017-04-20 6:35 ` [PATCH 3.18 084/124] Input: sur40 " Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 086/124] net/mlx5: Increase number of max QPs in default profile Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 087/124] net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 088/124] net: properly release sk_frag.page Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 089/124] net: unix: properly re-increment inflight counter of GC discarded candidates Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 090/124] socket, bpf: fix sk_filter use after free in sk_clone_lock Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 091/124] tcp: initialize icsk_ack.lrcvtime at session start time Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 092/124] mmc: ushc: fix NULL-deref at probe Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 093/124] uwb: hwa-rc: " Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 094/124] uwb: i1480-dfu: " Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 095/124] USB: usbtmc: add missing endpoint sanity check Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 096/124] iio: adc: ti_am335x_adc: fix fifo overrun recovery Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 097/124] ext4: mark inode dirty after converting inline directory Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 098/124] mmc: sdhci: Do not disable interrupts while waiting for clock Greg Kroah-Hartman
2017-04-20 6:36 ` Greg Kroah-Hartman [this message]
2017-04-20 6:36 ` [PATCH 3.18 100/124] igb: Workaround for igb i210 firmware issue Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 101/124] igb: add i211 to i210 PHY workaround Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 102/124] xfs: dont allow di_size with high bit set Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 103/124] xfs: fix up xfs_swap_extent_forks inline extent handling Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 104/124] xfs: clear _XBF_PAGES from buffers when readahead page Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 105/124] ACPI: Fix incompatibility with mcount-based function graph tracing Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 106/124] ACPI: Do not create a platform_device for IOAPIC/IOxAPIC Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 107/124] serial: 8250_pci: Detach low-level driver during PCI error recovery Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 108/124] [media] uvcvideo: uvc_scan_fallback() for webcams with broken chain Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 109/124] block: allow WRITE_SAME commands with the SG_IO ioctl Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 110/124] virtio_balloon: init 1st buffer in stats vq Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 111/124] pinctrl: qcom: Dont clear status bit on irq_unmask Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 112/124] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 114/124] mm/mempolicy.c: fix error handling in set_mempolicy and mbind Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 115/124] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 116/124] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 117/124] metag/usercopy: Drop unused macros Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 118/124] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 119/124] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 120/124] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 121/124] metag/usercopy: Set flags before ADDZ Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 122/124] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 123/124] metag/usercopy: Add missing fixups Greg Kroah-Hartman
2017-04-20 6:36 ` [PATCH 3.18 124/124] give up on gcc ilog2() constant optimizations Greg Kroah-Hartman
2017-04-20 13:46 ` [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck
2017-04-20 14:28 ` Greg Kroah-Hartman
2017-04-20 19:53 ` Greg Kroah-Hartman
2017-04-21 3:38 ` Guenter Roeck
2017-04-21 4:35 ` Greg Kroah-Hartman
2017-04-21 15:58 ` Guenter Roeck
2017-04-21 17:47 ` Greg Kroah-Hartman
[not found] ` <58f91c24.84a0df0a.dc1f9.4c38@mx.google.com>
2017-04-21 7:17 ` Greg Kroah-Hartman
2017-04-21 10:16 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170420063600.859357754@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jroedel@suse.de \
--cc=koos.vriezen@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).