linux-kernel - Re: [PATCH v2] iommu: Fix NULL pointer deref when io_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260128194644.0c76eeb3@gandalf.local.home>
Date: Wed, 28 Jan 2026 19:46:44 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Daniel Thompson <daniel@...cstar.com>
Cc: Masami Hiramatsu <mhiramat@...nel.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org, Will Deacon <will@...nel.org>, Robin
 Murphy <robin.murphy@....com>, linux-arm-kernel@...ts.infradead.org, Joerg
 Roedel <jroedel@...e.de>
Subject: Re: [PATCH v2] iommu: Fix NULL pointer deref when io_page_fault
 tracepoint fires


Note, event changes go through the maintainer's tree where the events are
used.

But from a tracing POV:

Reviewed-by: Steven Rostedt (Google) <rostedt@...dmis.org>

-- Steve


On Wed, 28 Jan 2026 15:48:01 +0000
Daniel Thompson <daniel@...cstar.com> wrote:

> The arm-smmu driver is unable to allocate the blame for a page fault to
> a specific device so it calls report_iommu_fault() with the dev argument
> set to NULL. Normally this doesn't cause anything catastrophic but on a
> system with the io_page_fault tracepoint enabled this results in a NULL
> pointer deref (resulting in a fairly spectacular crash on the hardware
> I'm currently working on).
> 
> Fix this by adding logic to the tracepoint to safely propagate NULL.
> 
> Fixes: f8f934c180f6 ("iommu/arm-smmu: Add support for driver IOMMU fault handlers")
> Signed-off-by: Daniel Thompson <daniel@...cstar.com>
> ---
> Changes in v2:
> - Add a Fixes:. It points to the earliest point I can find where it becomes
>   possible for the tracepoint to be triggered with dev set to NULL.
> - Link to v1: https://lore.kernel.org/r/20260116-iommu-io_page_fault_null_fix-v1-1-6c20c2e62987@riscstar.com
> ---
>  include/trace/events/iommu.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/trace/events/iommu.h b/include/trace/events/iommu.h
> index 373007e567cb827458a729b8200bbcc1b7d76912..1315193f13b8812ad4e29e6b0c0c66ca806ce08d 100644
> --- a/include/trace/events/iommu.h
> +++ b/include/trace/events/iommu.h
> @@ -131,8 +131,8 @@ DECLARE_EVENT_CLASS(iommu_error,
>  	TP_ARGS(dev, iova, flags),
>  
>  	TP_STRUCT__entry(
> -		__string(device, dev_name(dev))
> -		__string(driver, dev_driver_string(dev))
> +		__string(device, dev ? dev_name(dev) : NULL)
> +		__string(driver, dev ? dev_driver_string(dev) : NULL)
>  		__field(u64, iova)
>  		__field(int, flags)
>  	),
> 
> ---
> base-commit: 0f61b1860cc3f52aef9036d7235ed1f017632193
> change-id: 20260116-iommu-io_page_fault_null_fix-f81b4e8b5423
> 
> Best regards,