@samitouri / QOSamiQemu / commits / 78c25188e0

s390x/pci: prevent null pointer dereference during zpci hot unplug

vfio-pci hostdev realize during zpci hot plug fails (in `vfio_pci_realize()`) if the vfio group file in `/dev/vfio/` lacks appropriate permissions and the hostdev[/properties] addition doesn't reach the point where it could be associated with previously added zpci device (in `s390_pcihost_plug()`). As a result, zpci iommu pointer remains null. The zpci hot unplug following the failed hostdev addition assumes zpci iommu pointer was assigned and tries to make use of it to end the dma count resulting in a null pointer dereference. In the non-hotplug scenario, `qdev_unplug()` for the zpci device is not called after hostdev addition failure and this issue is not encountered. All other uses of zpci iommu without null check happens after both the zpci and hostdev(pci) devices are plugged and are safe from null dereference. Fixes: 37fa32de7073 ("s390x/pci: Honor DMA limits set by vfio") Signed-off-by: Aby Sam Ross <abysamross@ibm.com> Acked-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Suggested-by: Halil Pasic <pasic@linux.ibm.com> Message-ID: <b45cefc3147c2c8446772dab0f53d030fb92406a.1770963150.git.abysamross@ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>

Aby Sam Ross committed Feb 13, 2026 at 01:34 UTC 78c25188e02e356f4d7fd23941afd3074f5175b5

1 file changed +1 -1

hw/s390x/s390-pci-bus.c

+1 -1

@@ -1248,7 +1248,7 @@ static void s390_pcihost_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,

1248 pbdev->fid = 0;

1249 QTAILQ_REMOVE(&s->zpci_devs, pbdev, link);

1250 g_hash_table_remove(s->zpci_table, &pbdev->idx);

1251 - if (pbdev->iommu->dma_limit) {

1251 + if (pbdev->iommu && pbdev->iommu->dma_limit) {

1252 s390_pci_end_dma_count(s, pbdev->iommu->dma_limit);

1253 }

1254 qdev_unrealize(dev);