Re: [PATCH v2 06/12] media: iris: Skip DMA mask setup when the core device has no IOMMU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Silent DMA allocation fallback causing hardware breakage on updated device trees.

Pre-existing issues:
- [High] Race condition exposing uninitialized device leading to NULL pointer dereference or DMA misconfiguration.
--

--- Patch [6]: [PATCH v2 06/12] media: iris: Skip DMA mask setup when the core device has no IOMMU ---
commit 91265093c9bc3bb22f1e175614f1dde24649bf5b
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>

media: iris: Skip DMA mask setup when the core device has no IOMMU

This commit skips calling dma_set_mask_and_coherent() on the parent iris
device if it has no IOMMU mapped. It sets the DMA mask only when
device_iommu_mapped() reports an IOMMU on the core device, preventing
probe failures on newer platforms where "iommus" is on context bank subnodes.

Cc: stable@vger.kernel.org

> diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
> index 2594f5a67378a..c40c4ec44e83e 100644
> --- a/drivers/media/platform/qcom/iris/iris_probe.c
> +++ b/drivers/media/platform/qcom/iris/iris_probe.c
> @@ -310,9 +310,11 @@ static int iris_probe(struct platform_device *pdev)
>  
>  	dma_mask = core->iris_platform_data->dma_mask;
>  
> -	ret = dma_set_mask_and_coherent(dev, dma_mask);
> -	if (ret)
> -		goto err_vdev_unreg_enc;
> +	if (device_iommu_mapped(dev)) {
> +		ret = dma_set_mask_and_coherent(dev, dma_mask);
> +		if (ret)
> +			goto err_vdev_unreg_enc;
> +	}

[Severity: High]
Does this change introduce a silent DMA allocation fallback that could
cause SMMU faults or memory corruption at runtime?

If the new device tree bindings are used (where the "iommus" property is
moved to context bank subnodes), device_iommu_mapped(dev) returns false
and probe skips dma_set_mask_and_coherent().

However, if no platform actually implements the .init_cb_devs hook,
iris_init_cb_devs() will silently return success without creating the
context bank subdevices:

drivers/media/platform/qcom/iris/iris_probe.c:iris_init_cb_devs() {
	if (core->iris_platform_data->vpu_ops->init_cb_devs)
		return core->iris_platform_data->vpu_ops->init_cb_devs(core);

	return 0;
}

When DMA allocations occur, iris_get_cb_dev() falls back to the parent
core device which now has no IOMMU and an unconfigured DMA mask:

drivers/media/platform/qcom/iris/iris_resources.c:iris_get_cb_dev() {
	...
	return dev ? dev : core->dev;
}

[Severity: High]
This isn't a bug introduced by this patch, but there is a race condition
where device nodes are exposed to userspace before critical hardware setup
like DMA masks and PM runtime initialization occurs.

Earlier in iris_probe(), the video devices are registered:

drivers/media/platform/qcom/iris/iris_probe.c:iris_probe() {
	...
	ret = iris_register_video_device(core, DECODER);
	...
	ret = iris_register_video_device(core, ENCODER);
	...
}

Inside iris_register_video_device(), video_register_device() makes the
device accessible to userspace before video_set_drvdata() sets the driver
data:

drivers/media/platform/qcom/iris/iris_probe.c:iris_register_video_device() {
	...
	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
	if (ret)
		goto err_vdev_release;

	video_set_drvdata(vdev, core);
	...
}

If a userspace application like udev immediately opens the device,
iris_open() will retrieve a NULL pointer and trigger a NULL pointer
dereference when accessing core->dev:

drivers/media/platform/qcom/iris/iris_vidc.c:iris_open() {
	struct iris_core *core = video_drvdata(filp);
	...
	ret = pm_runtime_resume_and_get(core->dev);
	...
}

Even if video_set_drvdata() completes in time, iris_probe() registers the
video devices before executing dma_set_mask_and_coherent() and
devm_pm_runtime_enable(). Could this allow iris_open() to initiate PM/DMA
operations on an uninitialized hardware state?

>  
>  	dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
>  	dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731-vpu_iommu_iova_handling-v2-0-da52b5228dbd@oss.qualcomm.com?part=6