From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C31B02E8B8F for ; Tue, 9 Dec 2025 11:43:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765280641; cv=none; b=NKs+hzXHEY0DmVZ+ppBPCz3Td/MquKkvZ9LazkJ/DLNJBjDXPbx/lB6VdA5Avb5aG2kyBWgxhPZ8cxnbcxn3hgx4jmsGpGPSoKlS1qrC0qnV1V6ithcUsjehA5kWFvMxQjN6iAO26Q95lSBIsvWISw73juoAIs/3I5DrjamnEhg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765280641; c=relaxed/simple; bh=K+CbSWvOIPB4pqgGaG5NwofgUgluGHSM87vC6Aq9USM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=KXdoVzKlaKVztfhUri9otLPLHaXs3huNOcjnDnODTEPAS0nNeNtOx4uyWSVN+jQKtoHT9Gu8JSaG7uxYDQzoOWHwcos3Nn0fmcJA2ShTvmX9ihKRcSwedUwuXXpr1qYXHjRkXGNvmvuOxWd8d8/NRna4UnTASqwpklbahd8RTYQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 1583A1691; Tue, 9 Dec 2025 03:43:52 -0800 (PST) Received: from [10.57.46.210] (unknown [10.57.46.210]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id D19653F762; Tue, 9 Dec 2025 03:43:57 -0800 (PST) Message-ID: Date: Tue, 9 Dec 2025 11:43:55 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] iommu/rockchip: Check of_find_device_by_node() return value To: Haotian Zhang , Joerg Roedel , Will Deacon , Heiko Stuebner Cc: iommu@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org References: <20251209113333.1086-1-vulab@iscas.ac.cn> From: Robin Murphy Content-Language: en-GB In-Reply-To: <20251209113333.1086-1-vulab@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2025-12-09 11:33 am, Haotian Zhang wrote: > rk_iommu_of_xlate() calls of_find_device_by_node() without > verifying it is non-NULL, which can lead to a NULL pointer > dereference and crash. No, it can't. Please look at how of_xlate is called - at this point we are looking up the IOMMU device, which has a driver bound to it, which has registered ops against this of_node that are the only way to reach this function in the first place. If the device could have somehow disappeared from underneath an active driver, this potential crash is the least of the kernel's worries... Thanks, Robin. > Add a check for a NULL return from of_find_device_by_node() > and return -ENODEV upon failure. > > Fixes: 5fd577c3eac3 ("iommu/rockchip: Use OF_IOMMU to attach devices automatically") > Signed-off-by: Haotian Zhang > --- > drivers/iommu/rockchip-iommu.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c > index 0861dd469bd8..e59d0617574b 100644 > --- a/drivers/iommu/rockchip-iommu.c > +++ b/drivers/iommu/rockchip-iommu.c > @@ -1153,6 +1153,8 @@ static int rk_iommu_of_xlate(struct device *dev, > struct rk_iommudata *data; > > iommu_dev = of_find_device_by_node(args->np); > + if (!iommu_dev) > + return -ENODEV; > > data = devm_kzalloc(&iommu_dev->dev, sizeof(*data), GFP_KERNEL); > if (!data)