Re: [REGRESSION] qcom: iommu: nullpointer dereference on boot on apq8064

[Jason Gunthorpe <jgg@ziepe.ca>]

On Mon, Dec 29, 2025 at 11:26:42PM +0100, Christian Schrefl wrote:
> Hi everyone,
> 
> I've found a panic on boot with v6.19-rc3 on the asus-nexus7-flo tablet with a APQ8064 CPU.
> 
> I've bisected it down to commit bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper 
> probe path"). Reverting the drivers/iommu/iommu.c changes (removing the added if block)
> fixes the crash, but that presumably exists for a reason.
> The diff for the fix:
> ```
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index 2ca990dfbb88..9f32d70b207d 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -453,14 +453,6 @@ static int iommu_init_device(struct device *dev)
>          * already having a driver bound means dma_configure has already run and
>          * found no IOMMU to wait for, so there's no point calling it again.
>          */
> -       if (!dev->iommu->fwspec && !dev->driver && dev->bus->dma_configure) {
> -               mutex_unlock(&iommu_probe_device_lock);
> -               dev->bus->dma_configure(dev);
> -               mutex_lock(&iommu_probe_device_lock);
> -               /* If another instance finished the job for us, skip it */
> -               if (!dev->iommu || dev->iommu_group)
> -                       return -ENODEV;
> -       }
>         /*
>          * At this point, relevant devices either now have a fwspec which will
>          * match ops registered with a non-NULL fwnode, or we can reasonably
> ```

> [    5.900971] Call trace:
> [    5.900999]  qcom_iommu_of_xlate from of_iommu_xlate+0x7c/0x9c

Did you look at what line in qcom_iommu_of_xlate() is crashing with
NULL pointer?

It wasn't so obvious to me what it could be..

Though this looks really weird:

        struct msm_iommu_ctx_dev *master = dev_iommu_priv_get(dev);
        int sid;

        if (list_empty(&(*iommu)->ctx_list)) {
                master = kzalloc(sizeof(*master), GFP_ATOMIC);

So maybe master is NULL and !list_empty()? It is really confused, it
looks like it only adds exactly one entry to the ctx_list? Why have
the list?

Jason