iommu/omap: fix NULL pointer dereference

Fix this:

root at omap4430-panda:~# cat /debug/iommu/ducati/mem

[   62.725708] Unable to handle kernel NULL pointer dereference at virtual addre
ss 0000001c
[   62.725708] pgd = e6240000
[   62.737091] [0000001c] *pgd=a7168831, *pte=00000000, *ppte=00000000
[   62.743682] Internal error: Oops: 17 [#1] SMP
[   62.743682] Modules linked in: omap_iommu_debug omap_iovmm virtio_rpmsg_bus o
map_remoteproc remoteproc virtio_ring virtio mailbox_mach mailbox
[   62.743682] CPU: 0    Not tainted  (3.3.0-rc1-00265-g382f84e-dirty #682)
[   62.743682] PC is at debug_read_mem+0x5c/0xac [omap_iommu_debug]
[   62.743682] LR is at 0x1004
[   62.777832] pc : [<bf033178>]    lr : [<00001004>]    psr: 60000013
[   62.777832] sp : e72c7f40  ip : c0763c00  fp : 00000001
[   62.777832] r10: 00000000  r9 : 00000000  r8 : e72c7f80
[   62.777832] r7 : e6ffdc08  r6 : bed1ac78  r5 : 00001000  r4 : e7276000
[   62.777832] r3 : e60f3460  r2 : 00000000  r1 : e60f38c0  r0 : 00000000
[   62.777832] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   62.816375] Control: 10c53c7d  Table: a624004a  DAC: 00000015
[   62.816375] Process cat (pid: 1176, stack limit = 0xe72c62f8)
[   62.828369] Stack: (0xe72c7f40 to 0xe72c8000)
...
[   62.884185] [<bf033178>] (debug_read_mem+0x5c/0xac [omap_iommu_debug]) from [
<c010e354>] (vfs_read+0xac/0x130)
[   62.884185] [<c010e354>] (vfs_read+0xac/0x130) from [<c010e4a8>] (sys_read+0x
40/0x70)
[   62.884185] [<c010e4a8>] (sys_read+0x40/0x70) from [<c0014a00>] (ret_fast_sys

call+0x0/0x3c)

Fix also its 'echo bla > /debug/iommu/ducati/mem' Oops sibling, too.

Signed-off-by Ohad Ben-Cohen <[email protected]>

Cc Tony Lindgren <[email protected]>

Cc Hiroshi Doyu <[email protected]>

Cc Laurent Pinchart <[email protected]>

Cc Russell King <[email protected]>

Cc Joerg Roedel <[email protected]>

---
v2: omap_find_iovm_area only returns NULL for errors. thanks, rmk.

 drivers/iommu/omap-iommu-debug.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

drivers/iommu/omap-iommu-debug.c +2 -2

index bad9f9d..103dbd9 100644
@@ -274,7 +274,7 @@ static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
 	mutex_lock(&iommu_debug_lock);
 
 	area = omap_find_iovm_area(dev, (u32)ppos);
-	if (IS_ERR(area)) {
+	if (!area) {
 		bytes = -EINVAL;
 		goto err_out;
 	}

@@ -311,7 +311,7 @@ static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
 	}
 
 	area = omap_find_iovm_area(dev, (u32)ppos);
-	if (IS_ERR(area)) {
+	if (!area) {
 		count = -EINVAL;
 		goto err_out;
 	}

Signature · 1 line

1.7.5.4

I guess these patches are 3.3 material?

How about tagging them for stable too?

Quoted 1 line · Joerg Roedel

I guess these patches are 3.3 material?

Yes.

Quoted 1 line

How about tagging them for stable too?

Good point. But it's only relevant for this 2nd patch (the NULL pointer dereference fix), as the first one is a 3.3 regression. Let me know if you want me to resend the 2nd one with the stable tag.

Quoted 1 line · Joerg Roedel

I guess these patches are 3.3 material?

Yes.

Quoted 1 line

How about tagging them for stable too?

Good point. But it's only relevant for this 2nd patch (the NULL pointer dereference fix), as the first one is a 3.3 regression. Let me know if you want me to resend the 2nd one with the stable tag.

Applied both and added stable-tag to the second patch. I'll send the pull-request when you guys also send me the correct fix for the outstanding initialization order issue on OMAP.