dma-mapping: Protect dma_addressing_limited against NULL dma_mask
diff mbox series

Message ID 20190722111449.29258-1-eric.auger@redhat.com
State New
Headers show
Series
  • dma-mapping: Protect dma_addressing_limited against NULL dma_mask
Related show

Commit Message

Eric Auger July 22, 2019, 11:14 a.m. UTC
There are cases when the helper gets called when the dma_mask is NULL.

This is observed when running virtio-block-pci devices protected by
a virtual IOMMU. Guest crashes with NULL pointer dereference.

Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
---
 include/linux/dma-mapping.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Christoph Hellwig July 22, 2019, 11:43 a.m. UTC | #1
I posted a fix that takes care of this in SCSI this morning:

https://marc.info/?l=linux-scsi&m=156378725427719&w=2

I suspect for virtio-blk we should do the same.

>  static inline bool dma_addressing_limited(struct device *dev)
>  {
> -	return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
> -		dma_get_required_mask(dev);
> +	return dev->dma_mask ? min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
> +		dma_get_required_mask(dev) : false;

But to be on the safe side we could still do an early return here,
but it should have a WARN_ON_ONCE.

Patch
diff mbox series

diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index e11b115dd0e4..5e7f386fe0d2 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -689,8 +689,8 @@  static inline int dma_coerce_mask_and_coherent(struct device *dev, u64 mask)
  */
 static inline bool dma_addressing_limited(struct device *dev)
 {
-	return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
-		dma_get_required_mask(dev);
+	return dev->dma_mask ? min_not_zero(*dev->dma_mask, dev->bus_dma_mask) <
+		dma_get_required_mask(dev) : false;
 }
 
 #ifdef CONFIG_ARCH_HAS_SETUP_DMA_OPS