[PATCH] dmaengine: ioatdma: Fix NULL pointer dereference in ioat_alloc_chan_resources()

[Yang Zi]

ioat_alloc_chan_resources() performs MMIO accesses using
ioat_chan->reg_base without validating that the device's BAR mapping
(ioat_chan->ioat_dma->reg_base) is valid.  If the PCI BAR is not
properly mapped, reg_base is NULL and the channel's reg_base is computed
as NULL plus a small channel offset, so the first writew() touches an
address near NULL and faults.

KASAN/Oops report:

    BUG: kernel NULL pointer dereference, address: 0000000000000181
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0002) - not-present page
    RIP: 0010:ioat_alloc_chan_resources+0x40b/0x1ff0 [drivers/dma/ioat/init.c:679]

Validate the MMIO base before any register access and return -ENODEV if
it is not mapped.

Signed-off-by: Yang Zi <2959243019@xxxxxx>
---
 drivers/dma/ioat/init.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 737496391109..80dc8f36c346 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -677,6 +677,10 @@ static int ioat_alloc_chan_resources(struct dma_chan *c)
     if (ioat_chan->ring)
         return 1 << ioat_chan->alloc_order;
 
+    /* Validate the MMIO base before any register access. */
+    if (!ioat_chan->ioat_dma->reg_base)
+        return -ENODEV;
+
     /* Setup register to interrupt and write completion status on error */
     writew(IOAT_CHANCTRL_RUN, ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);