Commit 38e88440 authored by Louis-Alexis Eyraud's avatar Louis-Alexis Eyraud Committed by Joerg Roedel
Browse files

iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group 



Currently, mtk_iommu calls during probe iommu_device_register before
the hw_list from driver data is initialized. Since iommu probing issue
fix, it leads to NULL pointer dereference in mtk_iommu_device_group when
hw_list is accessed with list_first_entry (not null safe).

So, change the call order to ensure iommu_device_register is called
after the driver data are initialized.

Fixes: 9e3a2a64 ("iommu/mediatek: Adapt sharing and non-sharing pgtable case")
Fixes: bcb81ac6 ("iommu: Get DT/ACPI parsing into the proper probe path")
Reviewed-by: default avatarYong Wu <yong.wu@mediatek.com>
Tested-by: Chen-Yu Tsai <wenst@chromium.org> # MT8183 Juniper, MT8186 Tentacruel
Reviewed-by: default avatarAngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Tested-by: default avatarAngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: default avatarLouis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Link: https://lore.kernel.org/r/20250403-fix-mtk-iommu-error-v2-1-fe8b18f8b0a8@collabora.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 99deffc4

drivers/iommu/mtk_iommu.c

+13 −13
Original line number Diff line number Diff line
@@ -1372,15 +1372,6 @@ static int mtk_iommu_probe(struct platform_device *pdev) 
	platform_set_drvdata(pdev, data);

	mutex_init(&data->mutex);



	ret = iommu_device_sysfs_add(&data->iommu, dev, NULL,

				     "mtk-iommu.%pa", &ioaddr);

	if (ret)

		goto out_link_remove;



	ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);

	if (ret)

		goto out_sysfs_remove;



	if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE)) {

		list_add_tail(&data->list, data->plat_data->hw_list);

		data->hw_list = data->plat_data->hw_list;
@@ -1390,19 +1381,28 @@ static int mtk_iommu_probe(struct platform_device *pdev) 
		data->hw_list = &data->hw_list_head;

	}



	ret = iommu_device_sysfs_add(&data->iommu, dev, NULL,

				     "mtk-iommu.%pa", &ioaddr);

	if (ret)

		goto out_list_del;



	ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);

	if (ret)

		goto out_sysfs_remove;



	if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) {

		ret = component_master_add_with_match(dev, &mtk_iommu_com_ops, match);

		if (ret)

			goto out_list_del;

			goto out_device_unregister;

	}

	return ret;



out_list_del:

	list_del(&data->list);

out_device_unregister:

	iommu_device_unregister(&data->iommu);

out_sysfs_remove:

	iommu_device_sysfs_remove(&data->iommu);

out_link_remove:

out_list_del:

	list_del(&data->list);

	if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM))

		device_link_remove(data->smicomm_dev, dev);

out_runtime_disable: