Re: [PATCH v4 07/13] media: iris: Skip DMA mask setup when the core device has no IOMMU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Race condition leading to a NULL pointer dereference because the video device is registered before its private data and PM runtime are fully initialized.
--

commit 238457488dcd9147aa8709c84d5fae08c48163b9
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>

media: iris: Skip DMA mask setup when the core device has no IOMMU

Once the streams are described as context bank subnodes, the "iommus"
property no longer sits on the parent iris node. That device then has no
IOMMU domain of its own and never performs DMA directly, so calling
dma_set_mask_and_coherent() on it is meaningless.

> diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
> index debd1f0e57038..4bdb078d83b5c 100644
> --- a/drivers/media/platform/qcom/iris/iris_probe.c
> +++ b/drivers/media/platform/qcom/iris/iris_probe.c
> @@ -352,9 +352,11 @@ static int iris_probe(struct platform_device *pdev)
>  
>  	dma_mask = core->iris_platform_data->dma_mask;
>  
> -	ret = dma_set_mask_and_coherent(dev, dma_mask);
> -	if (ret)
> -		goto err_vdev_unreg_enc;
> +	if (device_iommu_mapped(dev)) {
> +		ret = dma_set_mask_and_coherent(dev, dma_mask);
> +		if (ret)
> +			goto err_vdev_unreg_enc;
> +	}

[Severity: High]
This isn't a bug introduced by this patch, but could this sequence leave a
window for a race condition where userspace accesses the video device before
it is fully initialized?

In iris_probe.c:iris_register_video_device(), the video node is registered
before the driver data is set:

	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
	if (ret)
		goto err_vdev_release;

	video_set_drvdata(vdev, core);

This exposes the /dev/videoX node to userspace immediately. If a process
like udev opens the device right away, iris_open() in iris_vidc.c can execute
before video_set_drvdata() or the remainder of iris_probe() completes.

If this happens, iris_open() calls video_drvdata() which returns a null
pointer. Passing this to pm_runtime_resume_and_get(core->dev) would then
cause a null pointer dereference.

Furthermore, exposing the device before devm_pm_runtime_enable() completes
further down in iris_probe() could leave the device in an uninitialized
state, resulting in unexpected access errors.

>  
>  	dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
>  	dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914-vpu_iommu_iova_handling-v4-0-9b9074a73c41@oss.qualcomm.com?part=7