[PATCH v2] platform: Fix race condition during DMA configure at IOMMU probe time

[PATCH v2] platform: Fix race condition during DMA configure at IOMMU probe time

[Will McVicker]

To avoid a race between the IOMMU probing thread and the device driver
async probing thread during configuration of the platform DMA, update
`platform_dma_configure()` to read `dev->driver` once and test if it's
NULL before using it. This ensures that we don't de-reference an invalid
platform driver pointer if the device driver is asynchronously bound
while configuring the DMA.

Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path")
Signed-off-by: Will McVicker <willmcvicker@google.com>
---
 drivers/base/platform.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 1813cfd0c4bd..cfccf3ff36e7 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -1440,7 +1440,7 @@ static void platform_shutdown(struct device *_dev)
 
 static int platform_dma_configure(struct device *dev)
 {
-	struct platform_driver *drv = to_platform_driver(dev->driver);
+	struct device_driver *drv = READ_ONCE(dev->driver);
 	struct fwnode_handle *fwnode = dev_fwnode(dev);
 	enum dev_dma_attr attr;
 	int ret = 0;
@@ -1451,8 +1451,8 @@ static int platform_dma_configure(struct device *dev)
 		attr = acpi_get_dma_attr(to_acpi_device_node(fwnode));
 		ret = acpi_dma_configure(dev, attr);
 	}
-	/* @drv may not be valid when we're called from the IOMMU layer */
-	if (ret || !dev->driver || drv->driver_managed_dma)
+	/* @dev->driver may not be valid when we're called from the IOMMU layer */
+	if (ret || !drv || to_platform_driver(drv)->driver_managed_dma)
 		return ret;
 
 	ret = iommu_device_use_default_domain(dev);
-- 
2.49.0.850.g28803427d3-goog

Re: [PATCH v2] platform: Fix race condition during DMA configure at IOMMU probe time

[Robin Murphy]

On 24/04/2025 7:04 pm, Will McVicker wrote:
> To avoid a race between the IOMMU probing thread and the device driver
> async probing thread during configuration of the platform DMA, update
> `platform_dma_configure()` to read `dev->driver` once and test if it's
> NULL before using it. This ensures that we don't de-reference an invalid
> platform driver pointer if the device driver is asynchronously bound
> while configuring the DMA.

Cheers Will! I have the corresponding changes for the other buses made 
locally (fortuitously, in exactly the same style!), so I'll get a commit 
message written up and those sent out tomorrow.

Reviewed-by: Robin Murphy <robin.murphy@arm.com>

> Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path")
> Signed-off-by: Will McVicker <willmcvicker@google.com>
> ---
>   drivers/base/platform.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index 1813cfd0c4bd..cfccf3ff36e7 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -1440,7 +1440,7 @@ static void platform_shutdown(struct device *_dev)
>   
>   static int platform_dma_configure(struct device *dev)
>   {
> -	struct platform_driver *drv = to_platform_driver(dev->driver);
> +	struct device_driver *drv = READ_ONCE(dev->driver);
>   	struct fwnode_handle *fwnode = dev_fwnode(dev);
>   	enum dev_dma_attr attr;
>   	int ret = 0;
> @@ -1451,8 +1451,8 @@ static int platform_dma_configure(struct device *dev)
>   		attr = acpi_get_dma_attr(to_acpi_device_node(fwnode));
>   		ret = acpi_dma_configure(dev, attr);
>   	}
> -	/* @drv may not be valid when we're called from the IOMMU layer */
> -	if (ret || !dev->driver || drv->driver_managed_dma)
> +	/* @dev->driver may not be valid when we're called from the IOMMU layer */
> +	if (ret || !drv || to_platform_driver(drv)->driver_managed_dma)
>   		return ret;
>   
>   	ret = iommu_device_use_default_domain(dev);