Skip to content

Commit 38e8844

Browse files
laeyraudjoergroedel
authored andcommitted
iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group
Currently, mtk_iommu calls during probe iommu_device_register before the hw_list from driver data is initialized. Since iommu probing issue fix, it leads to NULL pointer dereference in mtk_iommu_device_group when hw_list is accessed with list_first_entry (not null safe). So, change the call order to ensure iommu_device_register is called after the driver data are initialized. Fixes: 9e3a2a6 ("iommu/mediatek: Adapt sharing and non-sharing pgtable case") Fixes: bcb81ac ("iommu: Get DT/ACPI parsing into the proper probe path") Reviewed-by: Yong Wu <yong.wu@mediatek.com> Tested-by: Chen-Yu Tsai <wenst@chromium.org> # MT8183 Juniper, MT8186 Tentacruel Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Link: https://lore.kernel.org/r/20250403-fix-mtk-iommu-error-v2-1-fe8b18f8b0a8@collabora.com Signed-off-by: Joerg Roedel <jroedel@suse.de>
1 parent 99deffc commit 38e8844

File tree

1 file changed

+13
-13
lines changed

1 file changed

+13
-13
lines changed

drivers/iommu/mtk_iommu.c

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1372,15 +1372,6 @@ static int mtk_iommu_probe(struct platform_device *pdev)
13721372
platform_set_drvdata(pdev, data);
13731373
mutex_init(&data->mutex);
13741374

1375-
ret = iommu_device_sysfs_add(&data->iommu, dev, NULL,
1376-
"mtk-iommu.%pa", &ioaddr);
1377-
if (ret)
1378-
goto out_link_remove;
1379-
1380-
ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);
1381-
if (ret)
1382-
goto out_sysfs_remove;
1383-
13841375
if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE)) {
13851376
list_add_tail(&data->list, data->plat_data->hw_list);
13861377
data->hw_list = data->plat_data->hw_list;
@@ -1390,19 +1381,28 @@ static int mtk_iommu_probe(struct platform_device *pdev)
13901381
data->hw_list = &data->hw_list_head;
13911382
}
13921383

1384+
ret = iommu_device_sysfs_add(&data->iommu, dev, NULL,
1385+
"mtk-iommu.%pa", &ioaddr);
1386+
if (ret)
1387+
goto out_list_del;
1388+
1389+
ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);
1390+
if (ret)
1391+
goto out_sysfs_remove;
1392+
13931393
if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) {
13941394
ret = component_master_add_with_match(dev, &mtk_iommu_com_ops, match);
13951395
if (ret)
1396-
goto out_list_del;
1396+
goto out_device_unregister;
13971397
}
13981398
return ret;
13991399

1400-
out_list_del:
1401-
list_del(&data->list);
1400+
out_device_unregister:
14021401
iommu_device_unregister(&data->iommu);
14031402
out_sysfs_remove:
14041403
iommu_device_sysfs_remove(&data->iommu);
1405-
out_link_remove:
1404+
out_list_del:
1405+
list_del(&data->list);
14061406
if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM))
14071407
device_link_remove(data->smicomm_dev, dev);
14081408
out_runtime_disable:

0 commit comments

Comments
 (0)