Re: [PATCH v4 07/13] media: iris: Skip DMA mask setup when the core device has no IOMMU
From: sashiko-bot@kernel.org
Date: 2026-09-13 19:03:31
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Race condition leading to a NULL pointer dereference because the video device is registered before its private data and PM runtime are fully initialized. -- commit 238457488dcd9147aa8709c84d5fae08c48163b9 Author: Vikash Garodia [off-list ref] media: iris: Skip DMA mask setup when the core device has no IOMMU Once the streams are described as context bank subnodes, the "iommus" property no longer sits on the parent iris node. That device then has no IOMMU domain of its own and never performs DMA directly, so calling dma_set_mask_and_coherent() on it is meaningless.
quoted hunk ↗ jump to hunk
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c index debd1f0e57038..4bdb078d83b5c 100644 --- a/drivers/media/platform/qcom/iris/iris_probe.c +++ b/drivers/media/platform/qcom/iris/iris_probe.c@@ -352,9 +352,11 @@ static int iris_probe(struct platform_device *pdev) dma_mask = core->iris_platform_data->dma_mask; - ret = dma_set_mask_and_coherent(dev, dma_mask); - if (ret) - goto err_vdev_unreg_enc; + if (device_iommu_mapped(dev)) { + ret = dma_set_mask_and_coherent(dev, dma_mask); + if (ret) + goto err_vdev_unreg_enc; + }
[Severity: High] This isn't a bug introduced by this patch, but could this sequence leave a window for a race condition where userspace accesses the video device before it is fully initialized? In iris_probe.c:iris_register_video_device(), the video node is registered before the driver data is set: ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1); if (ret) goto err_vdev_release; video_set_drvdata(vdev, core); This exposes the /dev/videoX node to userspace immediately. If a process like udev opens the device right away, iris_open() in iris_vidc.c can execute before video_set_drvdata() or the remainder of iris_probe() completes. If this happens, iris_open() calls video_drvdata() which returns a null pointer. Passing this to pm_runtime_resume_and_get(core->dev) would then cause a null pointer dereference. Furthermore, exposing the device before devm_pm_runtime_enable() completes further down in iris_probe() could leave the device in an uninitialized state, resulting in unexpected access errors.
dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32)); dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260914-vpu_iommu_iova_handling-v4-0-9b9074a73c41@oss.qualcomm.com?part=7