torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

iommu/riscv: prevent NULL deref in iova_to_phys

Browse Source 
The riscv_iommu_pte_fetch() function returns either NULL for
unmapped/never-mapped iova, or a valid leaf pte pointer that
requires no further validation.

riscv_iommu_iova_to_phys() failed to handle NULL returns.
Prevent null pointer dereference in
riscv_iommu_iova_to_phys(), and remove the pte validation.

Fixes: 488ffbf181 ("iommu/riscv: Paging domain support")
Cc: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: XianLiang Huang <huangxianliang@lanxincomputing.com>
Link: https://lore.kernel.org/r/20250820072248.312-1-huangxianliang@lanxincomputing.com
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
This commit is contained in:
XianLiang Huang 2025-08-20 15:22:48 +08:00 committed by Joerg Roedel
parent 72b6f7cd89
commit 99d4d1a070
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/iommu/riscv/iommu.c
View File

@ -1283,7 +1283,7 @@ static phys_addr_t riscv_iommu_iova_to_phys(struct iommu_domain *iommu_domain,
unsigned long *ptr; unsigned long *ptr;
ptr = riscv_iommu_pte_fetch(domain, iova, &pte_size); ptr = riscv_iommu_pte_fetch(domain, iova, &pte_size);
if (_io_pte_none(*ptr) || !_io_pte_present(*ptr)) if (!ptr)
return 0; return 0;
return pfn_to_phys(__page_val_to_pfn(*ptr)) | (iova & (pte_size - 1)); return pfn_to_phys(__page_val_to_pfn(*ptr)) | (iova & (pte_size - 1));