Commit 99d4d1a0 authored by XianLiang Huang's avatar XianLiang Huang Committed by Joerg Roedel
Browse files

iommu/riscv: prevent NULL deref in iova_to_phys 



The riscv_iommu_pte_fetch() function returns either NULL for
unmapped/never-mapped iova, or a valid leaf pte pointer that
requires no further validation.

riscv_iommu_iova_to_phys() failed to handle NULL returns.
Prevent null pointer dereference in
riscv_iommu_iova_to_phys(), and remove the pte validation.

Fixes: 488ffbf1 ("iommu/riscv: Paging domain support")
Cc: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: default avatarXianLiang Huang <huangxianliang@lanxincomputing.com>
Link: https://lore.kernel.org/r/20250820072248.312-1-huangxianliang@lanxincomputing.com


Signed-off-by: default avatarJoerg Roedel <joerg.roedel@amd.com>
parent 72b6f7cd

drivers/iommu/riscv/iommu.c

+1 −1
Original line number Diff line number Diff line
@@ -1283,7 +1283,7 @@ static phys_addr_t riscv_iommu_iova_to_phys(struct iommu_domain *iommu_domain, 
	unsigned long *ptr;



	ptr = riscv_iommu_pte_fetch(domain, iova, &pte_size);

	if (_io_pte_none(*ptr) || !_io_pte_present(*ptr))

	if (!ptr)

		return 0;



	return pfn_to_phys(__page_val_to_pfn(*ptr)) | (iova & (pte_size - 1));