From de5a58a22ef3e7a9660f7a8cdc7f9ba48960399a Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 21 Oct 2025 15:28:19 +0200 Subject: [PATCH] VT-d: check bus_to_context_maddr()'s return value The function returning zero is an error indication; we shouldn't try to map MFN 0 and then treat that page as a context table. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: ef5b718cf81a2448118b86b86777f9430739445d master date: 2025-10-13 16:50:01 +0200 --- xen/drivers/passthrough/vtd/iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index f28de36458..1013475f7f 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1495,6 +1495,11 @@ int domain_context_mapping_one( ASSERT(pcidevs_locked()); spin_lock(&iommu->lock); maddr = bus_to_context_maddr(iommu, bus); + if ( !maddr ) + { + spin_unlock(&iommu->lock); + return -ENOMEM; + } context_entries = (struct context_entry *)map_vtd_domain_page(maddr); context = &context_entries[devfn]; old = (lctxt = *context).full; @@ -1887,6 +1892,12 @@ int domain_context_unmap_one( spin_lock(&iommu->lock); maddr = bus_to_context_maddr(iommu, bus); + if ( !maddr ) + { + ASSERT_UNREACHABLE(); + spin_unlock(&iommu->lock); + return 0; + } context_entries = (struct context_entry *)map_vtd_domain_page(maddr); context = &context_entries[devfn];