Commit 4317740a authored by Artem Chernyshev's avatar Artem Chernyshev Committed by ZhangPeng
Browse files

iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en 

stable inclusion
from stable-v6.6.44
commit b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb
bugzilla: https://gitee.com/openeuler/kernel/issues/IAHMJO

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb



--------------------------------

[ Upstream commit 630482ee0653decf9e2482ac6181897eb6cde5b8 ]

In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en()
dom->sdev is equal to NULL, which leads to null dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 9afea573 ("iommu/sprd: Release dma buffer to avoid memory leak")
Signed-off-by: default avatarArtem Chernyshev <artem.chernyshev@red-soft.ru>
Reviewed-by: default avatarChunyan Zhang <zhang.lyra@gmail.com>
Link: https://lore.kernel.org/r/20240716125522.3690358-1-artem.chernyshev@red-soft.ru


Signed-off-by: default avatarWill Deacon <will@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
parent a41f5681

drivers/iommu/sprd-iommu.c

+1 −1
Original line number Diff line number Diff line
@@ -232,8 +232,8 @@ static void sprd_iommu_cleanup(struct sprd_iommu_domain *dom) 


	pgt_size = sprd_iommu_pgt_size(&dom->domain);

	dma_free_coherent(dom->sdev->dev, pgt_size, dom->pgt_va, dom->pgt_pa);

	dom->sdev = NULL;

	sprd_iommu_hw_en(dom->sdev, false);

	dom->sdev = NULL;

}



static void sprd_iommu_domain_free(struct iommu_domain *domain)