linux-kernel - Re: [PATCH] memory: mtk-smi: Fix NULL pointer dereference in config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGmiHmFVUqCW0xv2U0C++OJPL5-vLKG_Jnkw0AkS=O_6tT5OiA@mail.gmail.com>
Date: Tue, 18 Nov 2025 14:15:17 +0800
From: Jian Hui Lee <jianhui.lee@...onical.com>
To: Krzysztof Kozlowski <krzk@...nel.org>
Cc: Yong Wu <yong.wu@...iatek.com>, Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, Joerg Roedel <jroedel@...e.de>, 
	linux-mediatek@...ts.infradead.org, linux-kernel@...r.kernel.org, 
	linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH] memory: mtk-smi: Fix NULL pointer dereference in config_port

On Fri, Nov 14, 2025 at 3:21 PM Krzysztof Kozlowski <krzk@...nel.org> wrote:
>
> On 14/11/2025 04:03, Jian Hui Lee wrote:
> > On Wed, Nov 12, 2025 at 11:51 PM Krzysztof Kozlowski <krzk@...nel.org> wrote:
> >>
> >> Please trim the traces from all irrelevant information.
> >>
> >>>
> >>> Fixes: e6dec92308628 ("iommu/mediatek: Add mt2712 IOMMU support")
> >>
> >> Add Cc stable.
> >>
> >>> Signed-off-by: Jian Hui Lee <jianhui.lee@...onical.com>
> >>
> >>> ---
> >>>  drivers/memory/mtk-smi.c | 4 ++++
> >>>  1 file changed, 4 insertions(+)
> >>>
> >>> diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
> >>> index 733e22f695ab..8eb043ff8280 100644
> >>> --- a/drivers/memory/mtk-smi.c
> >>> +++ b/drivers/memory/mtk-smi.c
> >>> @@ -244,6 +244,10 @@ static int mtk_smi_larb_config_port_gen2_general(struct device *dev)
> >>>       struct arm_smccc_res res;
> >>>       int i;
> >>>
> >>> +     /* larb->mmu and larb->bank are set in bind(), may not be ready yet */
> >>
> >> And how do you synchronize this between CPUs? IOW, what certainty you
> >> have that this CPU sees correct data and the checks below have any sense?
> >
> > Thank you for the review and for pointing this out. Moving
> > pm_runtime_enable/disable to component bind/unbind should ensure that
> > the synchronization happens correctly. I will send a v2 to address
> > those you mentioned.
>
> Runtime PM synchronizes nothing in this matter, so I don't understand
> what you want to achieve with it.

The original issue was a race condition where PM runtime resume could
be triggered before the device was fully initialized, causing NULL
pointer dereferences. So moving pm_runtime_enable from
mtk_smi_larb_probe to mtk_smi_larb_bind with the barrier presumably
fixes the issue:

@@ -171,6 +171,9 @@ mtk_smi_larb_bind(struct device *dev, struct
device *master, void *data)
                        larb->larbid = i;
                        larb->mmu = &larb_mmu[i].mmu;
                        larb->bank = larb_mmu[i].bank;
+                       smp_wmb();
+                       pm_runtime_enable(dev);
                        return 0;
                }
@@ -664,15 +668,13 @@ static int mtk_smi_larb_probe(struct
platform_device *pdev)
        if (ret < 0)
                return ret;

-       pm_runtime_enable(dev);
        platform_set_drvdata(pdev, larb);
        ret = component_add(dev, &mtk_smi_larb_component_ops);
        if (ret)

> Best regards,
> Krzysztof