git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From d046b770c9fc36ccb19c27afdb8322220108cbc7 Mon Sep 17 00:00:00 2001
   2 From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
   3 Date: Tue, 22 Sep 2015 14:59:20 -0700
   4 Subject: lib/iommu-common.c: do not try to deref a null iommu->lazy_flush() pointer when n < pool->hint
   5
   6 From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
   7
   8 commit d046b770c9fc36ccb19c27afdb8322220108cbc7 upstream.
   9
  10 The check for invoking iommu->lazy_flush() from iommu_tbl_range_alloc()
  11 has to be refactored so that we only call ->lazy_flush() if it is
  12 non-null.
  13
  14 I had a sparc kernel that was crashing when I was trying to process some
  15 very large perf.data files- the crash happens when the scsi driver calls
  16 into dma_4v_map_sg and thus the iommu_tbl_range_alloc().
  17
  18 Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
  19 Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  20 Cc: Guenter Roeck <linux@roeck-us.net>
  21 Cc: David S. Miller <davem@davemloft.net>
  22 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  23 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  lib/iommu-common.c |    6 +++---
  28  1 file changed, 3 insertions(+), 3 deletions(-)
  29
  30 --- a/lib/iommu-common.c
  31 +++ b/lib/iommu-common.c
  32 @@ -21,8 +21,7 @@ static        DEFINE_PER_CPU(unsigned int, iomm
  33
  34  static inline bool need_flush(struct iommu_map_table *iommu)
  35  {
  36 -       return (iommu->lazy_flush != NULL &&
  37 -               (iommu->flags & IOMMU_NEED_FLUSH) != 0);
  38 +       return ((iommu->flags & IOMMU_NEED_FLUSH) != 0);
  39  }
  40
  41  static inline void set_flush(struct iommu_map_table *iommu)
  42 @@ -211,7 +210,8 @@ unsigned long iommu_tbl_range_alloc(stru
  43                         goto bail;
  44                 }
  45         }
  46 -       if (n < pool->hint || need_flush(iommu)) {
  47 +       if (iommu->lazy_flush &&
  48 +           (n < pool->hint || need_flush(iommu))) {
  49                 clear_flush(iommu);
  50                 iommu->lazy_flush(iommu);
  51         }