diff options
| author | Niklas Schnelle <schnelle@linux.ibm.com> | 2026-08-18 21:13:17 +0200 |
|---|---|---|
| committer | Joerg Roedel <joerg.roedel@amd.com> | 2026-09-07 14:36:11 +0200 |
| commit | 20db6573301e66cd65ebf6c130b6563c69374d9d (patch) | |
| tree | 2ff17dba519696e7f2e8a0e79ccb485636f2f6be /scripts | |
| parent | 4c50bec3d54288230aafb7fe3d2930d42beb14fd (diff) | |
| download | linux-20db6573301e66cd65ebf6c130b6563c69374d9d.tar.gz linux-20db6573301e66cd65ebf6c130b6563c69374d9d.zip | |
iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX
get_rso_from_iova() returns NULL when the region-first entry is invalid.
Yet in get_rto_from_iova() the region-second origin rso is not checked
to be non-NULL before accessing rso[rsx] leading to a NULL pointer
dereference instead of a NULL return when iova_to_phys() is called on
a unmapped IOVA. Fix this by adding the missing NULL check.
Cc: stable@vger.kernel.org
Fixes: 81244074b518 ("iommu/s390: allow larger region tables")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions
