Commit 30a3f2f3 authored by Nicolin Chen's avatar Nicolin Chen Committed by Joerg Roedel
Browse files

iommu: Fix two issues in iommu_copy_struct_from_user() 

In the review for iommu_copy_struct_to_user() helper, Matt pointed out that
a NULL pointer should be rejected prior to dereferencing it:
https://lore.kernel.org/all/86881827-8E2D-461C-BDA3-FA8FD14C343C@nvidia.com

And Alok pointed out a typo at the same time:
https://lore.kernel.org/all/480536af-6830-43ce-a327-adbd13dc3f1d@oracle.com



Since both issues were copied from iommu_copy_struct_from_user(), fix them
first in the current header.

Fixes: e9d36c07 ("iommu: Add iommu_copy_struct_from_user helper")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicolin Chen <nicolinc@nvidia.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Acked-by: default avatarAlok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: default avatarMatthew R. Ochs <mochs@nvidia.com>
Link: https://lore.kernel.org/r/20250414191635.450472-1-nicolinc@nvidia.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 8dee308e

include/linux/iommu.h

+4 −4
Original line number Diff line number Diff line
@@ -440,10 +440,10 @@ static inline int __iommu_copy_struct_from_user( 
	void *dst_data, const struct iommu_user_data *src_data,

	unsigned int data_type, size_t data_len, size_t min_len)

{

	if (src_data->type != data_type)

		return -EINVAL;

	if (WARN_ON(!dst_data || !src_data))

		return -EINVAL;

	if (src_data->type != data_type)

		return -EINVAL;

	if (src_data->len < min_len || data_len < src_data->len)

		return -EINVAL;

	return copy_struct_from_user(dst_data, data_len, src_data->uptr,
@@ -456,8 +456,8 @@ static inline int __iommu_copy_struct_from_user( 
 *        include/uapi/linux/iommufd.h

 * @user_data: Pointer to a struct iommu_user_data for user space data info

 * @data_type: The data type of the @kdst. Must match with @user_data->type

 * @min_last: The last memember of the data structure @kdst points in the

 *            initial version.

 * @min_last: The last member of the data structure @kdst points in the initial

 *            version.

 * Return 0 for success, otherwise -error.

 */

#define iommu_copy_struct_from_user(kdst, user_data, data_type, min_last) \