This is a note to let you know that I've just added the patch titled
iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
to the 6.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iommu-sprd-avoid-null-deref-in-sprd_iommu_hw_en.patch
and it can be found in the queue-6.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 036fef95d080a4a448b0d055e627728e2801217e
Author: Artem Chernyshev <artem.chernyshev@xxxxxxxxxxx>
Date: Tue Jul 16 15:55:14 2024 +0300
iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
[ Upstream commit 630482ee0653decf9e2482ac6181897eb6cde5b8 ]
In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en()
dom->sdev is equal to NULL, which leads to null dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 9afea57384d4 ("iommu/sprd: Release dma buffer to avoid memory leak")
Signed-off-by: Artem Chernyshev <artem.chernyshev@xxxxxxxxxxx>
Reviewed-by: Chunyan Zhang <zhang.lyra@xxxxxxxxx>
Link: https://lore.kernel.org/r/20240716125522.3690358-1-artem.chernyshev@xxxxxxxxxxx
Signed-off-by: Will Deacon <will@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/iommu/sprd-iommu.c b/drivers/iommu/sprd-iommu.c
index ba53571a82390..a2f4ffe6d9491 100644
--- a/drivers/iommu/sprd-iommu.c
+++ b/drivers/iommu/sprd-iommu.c
@@ -232,8 +232,8 @@ static void sprd_iommu_cleanup(struct sprd_iommu_domain *dom)
pgt_size = sprd_iommu_pgt_size(&dom->domain);
dma_free_coherent(dom->sdev->dev, pgt_size, dom->pgt_va, dom->pgt_pa);
- dom->sdev = NULL;
sprd_iommu_hw_en(dom->sdev, false);
+ dom->sdev = NULL;
}
static void sprd_iommu_domain_free(struct iommu_domain *domain)
