similar to: [PATCH 0/2] Fix NULL pointer dereference with virtio-blk-pci and virtual IOMMU

On 22/07/2019 15:55, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at

On 22/07/2019 15:55, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at

We currently have cases where the dma_addressing_limited() gets called with dma_mask unset. This causes a NULL pointer dereference. Use dma_get_mask() accessor to prevent the crash. Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper") Signed-off-by: Eric Auger <eric.auger at redhat.com> --- v1 -> v2: - was [PATCH 1/2] dma-mapping: Protect

We currently have cases where the dma_addressing_limited() gets called with dma_mask unset. This causes a NULL pointer dereference. Use dma_get_mask() accessor to prevent the crash. Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper") Signed-off-by: Eric Auger <eric.auger at redhat.com> --- v1 -> v2: - was [PATCH 1/2] dma-mapping: Protect

On Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger

On Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger

Both split ring and packed ring use 32bits to describe the length of a descriptor: see struct vring_desc and struct vring_packed_desc. This means the max segment size supported by virtio is U32_MAX. An example of virtio_max_dma_size in virtio_blk.c: u32 v, max_size; max_size = virtio_max_dma_size(vdev); -> implicit convert err = virtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX,

On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk.c: > u32 v, max_size; > >

> static inline bool dma_addressing_limited(struct device *dev) > { > - return min_not_zero(*dev->dma_mask, dev->bus_dma_mask) < > - dma_get_required_mask(dev); > + return WARN_ON_ONCE(!dev->dma_mask) ? false : > + min_not_zero(*dev->dma_mask, dev->bus_dma_mask) < > + dma_get_required_mask(dev); This should really use a separate if statement, but I

On Wed, May 10, 2023 at 10:54:37AM +0800, zhenwei pi wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk.c: > u32 v, max_size; > > max_size =

On Wed, May 10, 2023 at 10:54:37AM +0800, zhenwei pi wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk.c: > u32 v, max_size; > > max_size =

On Wed, May 10, 2023 at 11:26:54AM +0800, Xuan Zhuo wrote: > On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > > Both split ring and packed ring use 32bits to describe the length of > > a descriptor: see struct vring_desc and struct vring_packed_desc. > > This means the max segment size supported by virtio is U32_MAX. > > >

On Wed, May 10, 2023 at 11:44?AM Michael S. Tsirkin <mst at redhat.com> wrote: > > On Wed, May 10, 2023 at 11:26:54AM +0800, Xuan Zhuo wrote: > > On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > > > Both split ring and packed ring use 32bits to describe the length of > > > a descriptor: see struct vring_desc and struct

Hi, here is the next version of this patch-set. Previous versions can be found here: V1: https://lore.kernel.org/lkml/20190110134433.15672-1-joro at 8bytes.org/ V2: https://lore.kernel.org/lkml/20190115132257.6426-1-joro at 8bytes.org/ V3: https://lore.kernel.org/lkml/20190123163049.24863-1-joro at 8bytes.org/ V4: https://lore.kernel.org/lkml/20190129084342.26030-1-joro at 8bytes.org/

On Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger

Hi, On 7/23/19 5:38 PM, Christoph Hellwig wrote: > On Mon, Jul 22, 2019 at 04:36:09PM +0100, Robin Murphy wrote: >>> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c >>> index c8be1c4f5b55..37c143971211 100644 >>> --- a/drivers/virtio/virtio_ring.c >>> +++ b/drivers/virtio/virtio_ring.c >>> @@ -262,7 +262,7 @@ size_t

Hi, On 7/23/19 5:38 PM, Christoph Hellwig wrote: > On Mon, Jul 22, 2019 at 04:36:09PM +0100, Robin Murphy wrote: >>> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c >>> index c8be1c4f5b55..37c143971211 100644 >>> --- a/drivers/virtio/virtio_ring.c >>> +++ b/drivers/virtio/virtio_ring.c >>> @@ -262,7 +262,7 @@ size_t

Hi Christoph, On 7/22/19 6:51 PM, Eric Auger wrote: > We currently have cases where the dma_addressing_limited() gets > called with dma_mask unset. This causes a NULL pointer dereference. > > Use dma_get_mask() accessor to prevent the crash. > > Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper") > Signed-off-by: Eric Auger <eric.auger at

dma_addressing_limited() should not be called on a device with a NULL dma_mask. If this occurs let's WARN_ON_ONCE and immediately return. Existing call sites are updated separately. Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper") Signed-off-by: Eric Auger <eric.auger at redhat.com> --- v1 -> v2: - add a WARN_ON_ONCE() - reword the commit message

Do not call dma_max_mapping_size for devices that have no DMA mask set, otherwise we can hit a NULL pointer dereference. This occurs when a virtio-blk-pci device is protected with a virtual IOMMU. Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") Signed-off-by: Eric Auger <eric.auger at redhat.com> Suggested-by: Christoph Hellwig <hch at lst.de> ---