Message ID | 20221018024258.19073-4-yong.wu@mediatek.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | iommu/mediatek: Improve safety from invalid dts input | expand |
On 18/10/2022 04:42, Yong Wu wrote: > The mtk_iommu_mm_dts_parse will parse the smi larbs nodes. if the i+1 > larb is parsed fail, we should put_device for the i..0 larbs. > > There are two places need to comment: > 1) The larbid may be not linear mapping, we should loop whole > the array in the error path. > 2) I move this line position: "data->larb_imu[id].dev = &plarbdev->dev;" > before "if (!plarbdev->dev.driver)", That means set > data->larb_imu[id].dev before the error path. then we don't need > "platform_device_put(plarbdev)" again in probe_defer case. All depend > on "put_device" of the error path in error cases. > > Fixes: d2e9a1102cfc ("iommu/mediatek: Contain MM IOMMU flow with the MM TYPE") > Signed-off-by: Yong Wu <yong.wu@mediatek.com> > Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> > --- > drivers/iommu/mtk_iommu.c | 27 ++++++++++++++++++++------- > 1 file changed, 20 insertions(+), 7 deletions(-) > > diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c > index 38112ad87d70..912322494bc0 100644 > --- a/drivers/iommu/mtk_iommu.c > +++ b/drivers/iommu/mtk_iommu.c > @@ -1055,8 +1055,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m > u32 id; > > larbnode = of_parse_phandle(dev->of_node, "mediatek,larbs", i); > - if (!larbnode) > - return -EINVAL; > + if (!larbnode) { > + ret = -EINVAL; > + goto err_larbdev_put; > + } > > if (!of_device_is_available(larbnode)) { > of_node_put(larbnode); > @@ -1069,14 +1071,16 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m > > plarbdev = of_find_device_by_node(larbnode); > of_node_put(larbnode); > - if (!plarbdev) > - return -ENODEV; > + if (!plarbdev) { > + ret = -ENODEV; > + goto err_larbdev_put; > + } > + data->larb_imu[id].dev = &plarbdev->dev; > > if (!plarbdev->dev.driver) { > - platform_device_put(plarbdev); > - return -EPROBE_DEFER; > + ret = -EPROBE_DEFER; > + goto err_larbdev_put; > } > - data->larb_imu[id].dev = &plarbdev->dev; > > component_match_add(dev, match, component_compare_dev, &plarbdev->dev); > platform_device_put(plarbdev); > @@ -1111,6 +1115,15 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m > return -EINVAL; > } > return 0; > + > +err_larbdev_put: > + /* id may be not linear mapping, loop whole the array */ > + for (i = MTK_LARB_NR_MAX - 1; i >= 0; i++) { > + if (!data->larb_imu[i].dev) > + continue; > + put_device(data->larb_imu[i].dev); > + } > + return ret; > } > > static int mtk_iommu_probe(struct platform_device *pdev)
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 38112ad87d70..912322494bc0 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1055,8 +1055,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m u32 id; larbnode = of_parse_phandle(dev->of_node, "mediatek,larbs", i); - if (!larbnode) - return -EINVAL; + if (!larbnode) { + ret = -EINVAL; + goto err_larbdev_put; + } if (!of_device_is_available(larbnode)) { of_node_put(larbnode); @@ -1069,14 +1071,16 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m plarbdev = of_find_device_by_node(larbnode); of_node_put(larbnode); - if (!plarbdev) - return -ENODEV; + if (!plarbdev) { + ret = -ENODEV; + goto err_larbdev_put; + } + data->larb_imu[id].dev = &plarbdev->dev; if (!plarbdev->dev.driver) { - platform_device_put(plarbdev); - return -EPROBE_DEFER; + ret = -EPROBE_DEFER; + goto err_larbdev_put; } - data->larb_imu[id].dev = &plarbdev->dev; component_match_add(dev, match, component_compare_dev, &plarbdev->dev); platform_device_put(plarbdev); @@ -1111,6 +1115,15 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m return -EINVAL; } return 0; + +err_larbdev_put: + /* id may be not linear mapping, loop whole the array */ + for (i = MTK_LARB_NR_MAX - 1; i >= 0; i++) { + if (!data->larb_imu[i].dev) + continue; + put_device(data->larb_imu[i].dev); + } + return ret; } static int mtk_iommu_probe(struct platform_device *pdev)