[Xen-changelog] [xen master] AMD/IOMMU: Fix crash in 'V' debugkey

[patchbot@xxxxxxx]

commit 85e1424de2dda289a4ee92e6b4f5328dd10e75ae
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Nov 13 13:19:36 2019 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Nov 13 14:32:44 2019 +0000

    AMD/IOMMU: Fix crash in 'V' debugkey
    
    c/s bb038f31168 "AMD/IOMMU: replace INTREMAP_ENTRIES" introduces a call to
    intremap_table_entries() in dump_intremap_table() before tbl.ptr is checked
    for NULL.
    
    intremap_table_entries() internally uses virt_to_page() which falls over
    
      ASSERT(va >= XEN_VIRT_START);
    
    in __virt_to_page().
    
    Reported-by: Igor Druzhinin <igor.druzhinin@xxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Release-acked-by: Juergen Gross <jgross@xxxxxxxx>
---
 xen/drivers/passthrough/amd/iommu_intr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/drivers/passthrough/amd/iommu_intr.c 
b/xen/drivers/passthrough/amd/iommu_intr.c
index 1eed60f265..5e92c023f8 100644
--- a/xen/drivers/passthrough/amd/iommu_intr.c
+++ b/xen/drivers/passthrough/amd/iommu_intr.c
@@ -847,11 +847,13 @@ static void dump_intremap_table(const struct amd_iommu 
*iommu,
                                 union irte_cptr tbl,
                                 const struct ivrs_mappings *ivrs_mapping)
 {
-    unsigned int count, nr = intremap_table_entries(tbl.ptr, iommu);
+    unsigned int count, nr;
 
     if ( !tbl.ptr )
         return;
 
+    nr = intremap_table_entries(tbl.ptr, iommu);
+
     for ( count = 0; count < nr; count++ )
     {
         if ( iommu->ctrl.ga_en
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog