diff options
| author | Niklas Schnelle <schnelle@linux.ibm.com> | 2026-08-18 21:13:17 +0200 |
|---|---|---|
| committer | Joerg Roedel <joerg.roedel@amd.com> | 2026-09-07 14:36:11 +0200 |
| commit | 20db6573301e66cd65ebf6c130b6563c69374d9d (patch) | |
| tree | 2ff17dba519696e7f2e8a0e79ccb485636f2f6be | |
| parent | 4c50bec3d54288230aafb7fe3d2930d42beb14fd (diff) | |
| download | linux-next-20db6573301e66cd65ebf6c130b6563c69374d9d.tar.gz linux-next-20db6573301e66cd65ebf6c130b6563c69374d9d.zip | |
iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
get_rso_from_iova() returns NULL when the region-first entry is invalid.
Yet in get_rto_from_iova() the region-second origin rso is not checked
to be non-NULL before accessing rso[rsx] leading to a NULL pointer
dereference instead of a NULL return when iova_to_phys() is called on
a unmapped IOVA. Fix this by adding the missing NULL check.
Cc: stable@vger.kernel.org
Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
| -rw-r--r-- | drivers/iommu/s390-iommu.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c index f148f559ac56..58ca7727b7f2 100644 --- a/drivers/iommu/s390-iommu.c +++ b/drivers/iommu/s390-iommu.c @@ -974,6 +974,8 @@ static unsigned long *get_rto_from_iova(struct s390_domain *domain, case ZPCI_TABLE_TYPE_RFX: case ZPCI_TABLE_TYPE_RSX: rso = get_rso_from_iova(domain, iova); + if (!rso) + return NULL; rsx = calc_rsx(iova); rse = READ_ONCE(rso[rsx]); if (!reg_entry_isvalid(rse)) |