[PATCH] iommu: Fix NULL pointer deref when io_page_fault tracepoint fires
Daniel Thompson
daniel at riscstar.com
Fri Jan 16 04:09:37 PST 2026
The arm-smmu driver is unable to allocate the blame for a page fault to
a specific device so it calls report_iommu_fault() with the dev argument
set to NULL. Normally this doesn't cause anything catastrophic but on a
system with the io_page_fault tracepoint enabled this results in a NULL
pointer deref (resulting in a fairly spectacular crash on the hardware
I'm currently working on).
Fix this by adding logic to the tracepoint to safely propagate NULL.
Signed-off-by: Daniel Thompson <daniel at riscstar.com>
---
include/trace/events/iommu.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/trace/events/iommu.h b/include/trace/events/iommu.h
index 373007e567cb827458a729b8200bbcc1b7d76912..1315193f13b8812ad4e29e6b0c0c66ca806ce08d 100644
--- a/include/trace/events/iommu.h
+++ b/include/trace/events/iommu.h
@@ -131,8 +131,8 @@ DECLARE_EVENT_CLASS(iommu_error,
TP_ARGS(dev, iova, flags),
TP_STRUCT__entry(
- __string(device, dev_name(dev))
- __string(driver, dev_driver_string(dev))
+ __string(device, dev ? dev_name(dev) : NULL)
+ __string(driver, dev ? dev_driver_string(dev) : NULL)
__field(u64, iova)
__field(int, flags)
),
---
base-commit: 0f61b1860cc3f52aef9036d7235ed1f017632193
change-id: 20260116-iommu-io_page_fault_null_fix-f81b4e8b5423
Best regards,
--
Daniel Thompson <daniel at riscstar.com>
More information about the linux-arm-kernel
mailing list