On Fri, 03 Feb 2023 16:28:18 +0530, Anton Gusev wrote

I am trying to investigate a potential NULL dereference in drivers/firmware/efi/efi.c in the function efi_mem_reserve_persistent.

In it, a result of memremap call is dereferenced without null checks. I'd like to understand if it's an error or if there is some sort of invariant that guarantees it will never return NULL.

Indeed, every pointer which can be NULL must be checked for it. The code should check the returned value in rsv for NULL and break.

For this I need to know when memremap (or the underlying ioremap, I guess) might return NULL. Just looking into its source code didn't give me much insight.

Do you know any articles/documentation on how memremap and/or ioremap work?

What topics should I study to understand more about it?

There's an article on LWN: https://lwn.net/Articles/653585/, though if you want to understand the mechanics, it seems like you will have to dive into the code. But your observation is indeed correct. You should send a patch. Fixes tag may have 18df7577adae6. Thanks, Siddh