From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752220AbdHXMcw (ORCPT ); Thu, 24 Aug 2017 08:32:52 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:32931 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751272AbdHXMcv (ORCPT ); Thu, 24 Aug 2017 08:32:51 -0400 Date: Thu, 24 Aug 2017 15:32:26 +0300 From: Dan Carpenter To: Baoquan He Cc: iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org, joro@8bytes.org Subject: Re: [PATCH] iommu/amd: Check if domain is NULL before dereference it Message-ID: <20170824123226.57twp5sdh246l5kz@mwanda> References: <1503575807-15746-1-git-send-email-bhe@redhat.com> <20170824121137.dgsy57bq3qsjvjqj@mwanda> <20170824122251.GG19768@x1> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170824122251.GG19768@x1> User-Agent: NeoMutt/20170113 (1.7.2) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Take a look at this code for example. But all the places which call get_domain() are the same: drivers/iommu/amd_iommu.c 2648 page = virt_to_page(virt_addr); 2649 size = PAGE_ALIGN(size); 2650 2651 domain = get_domain(dev); ^^^^^^^^^^^^^^ imagined get_domain() returns NULL. 2652 if (IS_ERR(domain)) 2653 goto free_mem; 2654 2655 dma_dom = to_dma_ops_domain(domain); ^^^^^^^^^^^^^^^^^^^^^^^^^ This will Oops. 2656 regards, dan carpenter