[Xen-changelog] [xen-3.4-testing] vt-d: Fixpanic in msi_msg_read_remap_rte with acpi=off

["Xen patchbot-3.4-testing" <patchbot-3.4-testing@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1255679937 -3600
# Node ID adb8716ef44bad5fd987a211d4fe3e2dee3e32c6
# Parent  b0442d0a52754a6b5154d29b2b01d44e2a5541e4
vt-d: Fixpanic in msi_msg_read_remap_rte with acpi=off

Xen panics when "acpi=off noacpi" is set. Problem is caused by
dereferencing NULL pointer in drhd after calling
acpi_find_matched_drhd_unit. As acpi_find_matched_drhd_unit can
return NULL, checks has to be done before returned value is used.

From: Miroslav Rezanina <mrezanin@xxxxxxxxxx>
Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxxxxx>
xen-unstable changeset:   20323:2370e16ab6d3
xen-unstable date:        Fri Oct 16 08:28:47 2009 +0100
---
 xen/drivers/passthrough/vtd/intremap.c |    6 ++++--
 xen/drivers/passthrough/vtd/iommu.c    |    5 +++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff -r b0442d0a5275 -r adb8716ef44b xen/drivers/passthrough/vtd/intremap.c
--- a/xen/drivers/passthrough/vtd/intremap.c    Fri Oct 16 08:57:25 2009 +0100
+++ b/xen/drivers/passthrough/vtd/intremap.c    Fri Oct 16 08:58:57 2009 +0100
@@ -460,7 +460,8 @@ void msi_msg_read_remap_rte(
     struct iommu *iommu = NULL;
     struct ir_ctrl *ir_ctrl;
 
-    drhd = acpi_find_matched_drhd_unit(pdev);
+    if ( (drhd = acpi_find_matched_drhd_unit(pdev)) == NULL )
+        return;
     iommu = drhd->iommu;
 
     ir_ctrl = iommu_ir_ctrl(iommu);
@@ -478,7 +479,8 @@ void msi_msg_write_remap_rte(
     struct iommu *iommu = NULL;
     struct ir_ctrl *ir_ctrl;
 
-    drhd = acpi_find_matched_drhd_unit(pdev);
+    if ( (drhd = acpi_find_matched_drhd_unit(pdev)) == NULL )
+        return;
     iommu = drhd->iommu;
 
     ir_ctrl = iommu_ir_ctrl(iommu);
diff -r b0442d0a5275 -r adb8716ef44b xen/drivers/passthrough/vtd/iommu.c
--- a/xen/drivers/passthrough/vtd/iommu.c       Fri Oct 16 08:57:25 2009 +0100
+++ b/xen/drivers/passthrough/vtd/iommu.c       Fri Oct 16 08:58:57 2009 +0100
@@ -1411,7 +1411,8 @@ static int reassign_device_ownership(
     if (!pdev)
         return -ENODEV;
 
-    drhd = acpi_find_matched_drhd_unit(pdev);
+    if ( (drhd = acpi_find_matched_drhd_unit(pdev)) == NULL )
+        return -ENODEV;
     pdev_iommu = drhd->iommu;
     domain_context_unmap(source, bus, devfn);
 
@@ -1425,7 +1426,7 @@ static int reassign_device_ownership(
     for_each_pdev ( source, pdev )
     {
         drhd = acpi_find_matched_drhd_unit(pdev);
-        if ( drhd->iommu == pdev_iommu )
+        if ( drhd && drhd->iommu == pdev_iommu )
         {
             found = 1;
             break;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog