Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chenyuan Mi <cymi20@fudan.edu.cn>
To:     joro@8bytes.org
Cc:     will@kernel.org, robin.murphy@arm.com, iommu@lists.linux.dev,
        linux-kernel@vger.kernel.org, Chenyuan Mi <cymi20@fudan.edu.cn>
Subject: [PATCH] iommu: Fix missing check for return value of iommu_group_get()
Date:   Wed, 14 Jun 2023 08:43:08 -0700
Message-Id: <20230614154308.118783-1-cymi20@fudan.edu.cn>
Precedence: bulk

The iommu_group_get() function may return NULL, which may
cause null pointer deference, and most other callsites of
iommu_group_get() do Null check. Add Null check for return
value of iommu_group_get().

Found by our static analysis tool.

Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
---
 drivers/iommu/iommu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index f1dcfa3f1a1b..ef3483e75511 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -3217,6 +3217,8 @@ EXPORT_SYMBOL_GPL(iommu_group_release_dma_owner);
 void iommu_device_release_dma_owner(struct device *dev)
 {
 	struct iommu_group *group = iommu_group_get(dev);
+	if (!group)
+		return;
 
 	mutex_lock(&group->mutex);
 	if (group->owner_cnt > 1)
@@ -3329,6 +3331,8 @@ void iommu_detach_device_pasid(struct iommu_domain *domain, struct device *dev,
 			       ioasid_t pasid)
 {
 	struct iommu_group *group = iommu_group_get(dev);
+	if (!group)
+		return;
 
 	mutex_lock(&group->mutex);
 	__iommu_remove_group_pasid(group, pasid);
-- 
2.17.1