Re: [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] V4L2 video devices are registered before probe is complete, and the main `core` structure is tied to the device lifetime via `devm_kzalloc()`, leading to race conditions and Use-After-Free vulnerabilities upon probe failure or unbind.
--

--- Patch [5]: [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped ---
commit 9521732c3739228afd507693479032190d343a3f
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>

media: iris: Skip DMA mask setting to core device when IOMMU is not mapped

The non-pixel and pixel subnodes move the IOMMU streams away from the
iris parent device. As a result, the core device may not have an IOMMU
mapping, and setting its DMA mask is unnecessary.

> diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
> index 2594f5a67378a..c40c4ec44e83e 100644
> --- a/drivers/media/platform/qcom/iris/iris_probe.c
> +++ b/drivers/media/platform/qcom/iris/iris_probe.c
> @@ -310,9 +310,11 @@ static int iris_probe(struct platform_device *pdev)
>  
>  	dma_mask = core->iris_platform_data->dma_mask;
>  
> -	ret = dma_set_mask_and_coherent(dev, dma_mask);
> -	if (ret)
> -		goto err_vdev_unreg_enc;
> +	if (device_iommu_mapped(dev)) {
> +		ret = dma_set_mask_and_coherent(dev, dma_mask);
> +		if (ret)
> +			goto err_vdev_unreg_enc;
> +	}

[Severity: High]
This is a pre-existing issue, but does this probe sequence expose a
use-after-free regression if probe fails?

In iris_probe(), the core structure is allocated with devm_kzalloc(). Later,
video devices are registered before the hardware and PM runtime are fully
initialized.

If userspace opens the newly created video node during this window, it
obtains a file descriptor referencing the core structure:

iris_vidc.c:iris_open() {
    ...
    ret = pm_runtime_resume_and_get(core->dev);
    ...
}

If a subsequent step in iris_probe() fails (such as returning an error
after dma_set_mask_and_coherent), the driver returns an error and devres
automatically frees the core structure.

However, the userspace file descriptor remains open. When the process later
calls close(), the driver attempts to access the freed core structure:

iris_vidc.c:iris_close() {
    ...
    iris_check_num_queued_internal_buffers(inst, ...);
    ...
}

Could this be fixed by moving video device registration to the very end of
probe, or by managing the core structure lifetime via the v4l2 device
release callback instead of devres?

>  
>  	dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
>  	dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=5