diff mbox series

iommu/arm-smmu: Defer probe of clients after smmu device bound

Message ID 20241001055633.21062-1-quic_pbrahma@quicinc.com (mailing list archive)
State New, archived
Headers show
Series iommu/arm-smmu: Defer probe of clients after smmu device bound | expand

Commit Message

Pratyush Brahma Oct. 1, 2024, 5:56 a.m. UTC 
Null pointer dereference occurs due to a race between smmu
driver probe and client driver probe, when of_dma_configure()
for client is called after the iommu_device_register() for smmu driver
probe has executed but before the driver_bound() for smmu driver
has been called.

Following is how the race occurs:

T1:Smmu device probe		T2: Client device probe

really_probe()
arm_smmu_device_probe()
iommu_device_register()
					really_probe()
					platform_dma_configure()
					of_dma_configure()
					of_dma_configure_id()
					of_iommu_configure()
					iommu_probe_device()
					iommu_init_device()
					arm_smmu_probe_device()
					arm_smmu_get_by_fwnode()
						driver_find_device_by_fwnode()
						driver_find_device()
						next_device()
						klist_next()
							/* null ptr
							assigned to smmu */
					/* null ptr dereference
					while smmu->streamid_mask */
driver_bound()
	klist_add_tail()

When this null smmu pointer is dereferenced later in
arm_smmu_probe_device, the device crashes.

Fix this by deferring the probe of the client device
until the smmu device has bound to the arm smmu driver.

Co-developed-by: Prakash Gupta <quic_guptap@quicinc.com>
Signed-off-by: Prakash Gupta <quic_guptap@quicinc.com>
Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
Fixes: 021bb8420d44 ("iommu/arm-smmu: Wire up generic configuration support")
---
 drivers/iommu/arm/arm-smmu/arm-smmu.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

kernel test robot Oct. 2, 2024, 12:14 a.m. UTC | #1 
Hi Pratyush,

kernel test robot noticed the following build warnings:

[auto build test WARNING on soc/for-next]
[also build test WARNING on linus/master v6.12-rc1 next-20241001]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Pratyush-Brahma/iommu-arm-smmu-Defer-probe-of-clients-after-smmu-device-bound/20241001-135852
base:   https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git for-next
patch link:    https://lore.kernel.org/r/20241001055633.21062-1-quic_pbrahma%40quicinc.com
patch subject: [PATCH] iommu/arm-smmu: Defer probe of clients after smmu device bound
config: i386-buildonly-randconfig-004-20241002 (https://download.01.org/0day-ci/archive/20241002/202410020820.gY0d4AkK-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241002/202410020820.gY0d4AkK-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202410020820.gY0d4AkK-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/iommu/arm/arm-smmu/arm-smmu.c: In function 'arm_smmu_probe_device':
>> drivers/iommu/arm/arm-smmu/arm-smmu.c:1441:32: warning: returning 'int' from a function with return type 'struct iommu_device *' makes pointer from integer without a cast [-Wint-conversion]
    1441 |                         return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
         |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +1441 drivers/iommu/arm/arm-smmu/arm-smmu.c

  1419	
  1420	static struct iommu_device *arm_smmu_probe_device(struct device *dev)
  1421	{
  1422		struct arm_smmu_device *smmu = NULL;
  1423		struct arm_smmu_master_cfg *cfg;
  1424		struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
  1425		int i, ret;
  1426	
  1427		if (using_legacy_binding) {
  1428			ret = arm_smmu_register_legacy_master(dev, &smmu);
  1429	
  1430			/*
  1431			 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
  1432			 * will allocate/initialise a new one. Thus we need to update fwspec for
  1433			 * later use.
  1434			 */
  1435			fwspec = dev_iommu_fwspec_get(dev);
  1436			if (ret)
  1437				goto out_free;
  1438		} else {
  1439			smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);
  1440			if (!smmu)
> 1441				return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
  1442		}
  1443	
  1444		ret = -EINVAL;
  1445		for (i = 0; i < fwspec->num_ids; i++) {
  1446			u16 sid = FIELD_GET(ARM_SMMU_SMR_ID, fwspec->ids[i]);
  1447			u16 mask = FIELD_GET(ARM_SMMU_SMR_MASK, fwspec->ids[i]);
  1448	
  1449			if (sid & ~smmu->streamid_mask) {
  1450				dev_err(dev, "stream ID 0x%x out of range for SMMU (0x%x)\n",
  1451					sid, smmu->streamid_mask);
  1452				goto out_free;
  1453			}
  1454			if (mask & ~smmu->smr_mask_mask) {
  1455				dev_err(dev, "SMR mask 0x%x out of range for SMMU (0x%x)\n",
  1456					mask, smmu->smr_mask_mask);
  1457				goto out_free;
  1458			}
  1459		}
  1460	
  1461		ret = -ENOMEM;
  1462		cfg = kzalloc(offsetof(struct arm_smmu_master_cfg, smendx[i]),
  1463			      GFP_KERNEL);
  1464		if (!cfg)
  1465			goto out_free;
  1466	
  1467		cfg->smmu = smmu;
  1468		dev_iommu_priv_set(dev, cfg);
  1469		while (i--)
  1470			cfg->smendx[i] = INVALID_SMENDX;
  1471	
  1472		ret = arm_smmu_rpm_get(smmu);
  1473		if (ret < 0)
  1474			goto out_cfg_free;
  1475	
  1476		ret = arm_smmu_master_alloc_smes(dev);
  1477		arm_smmu_rpm_put(smmu);
  1478	
  1479		if (ret)
  1480			goto out_cfg_free;
  1481	
  1482		device_link_add(dev, smmu->dev,
  1483				DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_SUPPLIER);
  1484	
  1485		return &smmu->iommu;
  1486	
  1487	out_cfg_free:
  1488		kfree(cfg);
  1489	out_free:
  1490		iommu_fwspec_free(dev);
  1491		return ERR_PTR(ret);
  1492	}
  1493
kernel test robot Oct. 2, 2024, 1:07 a.m. UTC | #2 
Hi Pratyush,

kernel test robot noticed the following build errors:

[auto build test ERROR on soc/for-next]
[also build test ERROR on linus/master v6.12-rc1 next-20241001]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Pratyush-Brahma/iommu-arm-smmu-Defer-probe-of-clients-after-smmu-device-bound/20241001-135852
base:   https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git for-next
patch link:    https://lore.kernel.org/r/20241001055633.21062-1-quic_pbrahma%40quicinc.com
patch subject: [PATCH] iommu/arm-smmu: Defer probe of clients after smmu device bound
config: s390-allyesconfig (https://download.01.org/0day-ci/archive/20241002/202410020856.Gp3LtJKA-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 14.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241002/202410020856.Gp3LtJKA-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202410020856.Gp3LtJKA-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/iommu/arm/arm-smmu/arm-smmu.c: In function 'arm_smmu_probe_device':
>> drivers/iommu/arm/arm-smmu/arm-smmu.c:1441:32: error: returning 'int' from a function with return type 'struct iommu_device *' makes pointer from integer without a cast [-Wint-conversion]
    1441 |                         return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
         |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


vim +1441 drivers/iommu/arm/arm-smmu/arm-smmu.c

  1419	
  1420	static struct iommu_device *arm_smmu_probe_device(struct device *dev)
  1421	{
  1422		struct arm_smmu_device *smmu = NULL;
  1423		struct arm_smmu_master_cfg *cfg;
  1424		struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
  1425		int i, ret;
  1426	
  1427		if (using_legacy_binding) {
  1428			ret = arm_smmu_register_legacy_master(dev, &smmu);
  1429	
  1430			/*
  1431			 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
  1432			 * will allocate/initialise a new one. Thus we need to update fwspec for
  1433			 * later use.
  1434			 */
  1435			fwspec = dev_iommu_fwspec_get(dev);
  1436			if (ret)
  1437				goto out_free;
  1438		} else {
  1439			smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);
  1440			if (!smmu)
> 1441				return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
  1442		}
  1443	
  1444		ret = -EINVAL;
  1445		for (i = 0; i < fwspec->num_ids; i++) {
  1446			u16 sid = FIELD_GET(ARM_SMMU_SMR_ID, fwspec->ids[i]);
  1447			u16 mask = FIELD_GET(ARM_SMMU_SMR_MASK, fwspec->ids[i]);
  1448	
  1449			if (sid & ~smmu->streamid_mask) {
  1450				dev_err(dev, "stream ID 0x%x out of range for SMMU (0x%x)\n",
  1451					sid, smmu->streamid_mask);
  1452				goto out_free;
  1453			}
  1454			if (mask & ~smmu->smr_mask_mask) {
  1455				dev_err(dev, "SMR mask 0x%x out of range for SMMU (0x%x)\n",
  1456					mask, smmu->smr_mask_mask);
  1457				goto out_free;
  1458			}
  1459		}
  1460	
  1461		ret = -ENOMEM;
  1462		cfg = kzalloc(offsetof(struct arm_smmu_master_cfg, smendx[i]),
  1463			      GFP_KERNEL);
  1464		if (!cfg)
  1465			goto out_free;
  1466	
  1467		cfg->smmu = smmu;
  1468		dev_iommu_priv_set(dev, cfg);
  1469		while (i--)
  1470			cfg->smendx[i] = INVALID_SMENDX;
  1471	
  1472		ret = arm_smmu_rpm_get(smmu);
  1473		if (ret < 0)
  1474			goto out_cfg_free;
  1475	
  1476		ret = arm_smmu_master_alloc_smes(dev);
  1477		arm_smmu_rpm_put(smmu);
  1478	
  1479		if (ret)
  1480			goto out_cfg_free;
  1481	
  1482		device_link_add(dev, smmu->dev,
  1483				DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_SUPPLIER);
  1484	
  1485		return &smmu->iommu;
  1486	
  1487	out_cfg_free:
  1488		kfree(cfg);
  1489	out_free:
  1490		iommu_fwspec_free(dev);
  1491		return ERR_PTR(ret);
  1492	}
  1493
kernel test robot Oct. 2, 2024, 2:30 a.m. UTC | #3 
Hi Pratyush,

kernel test robot noticed the following build errors:

[auto build test ERROR on soc/for-next]
[also build test ERROR on linus/master v6.12-rc1 next-20241001]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Pratyush-Brahma/iommu-arm-smmu-Defer-probe-of-clients-after-smmu-device-bound/20241001-135852
base:   https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git for-next
patch link:    https://lore.kernel.org/r/20241001055633.21062-1-quic_pbrahma%40quicinc.com
patch subject: [PATCH] iommu/arm-smmu: Defer probe of clients after smmu device bound
config: s390-allmodconfig (https://download.01.org/0day-ci/archive/20241002/202410021015.OHF2CJsc-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project fef3566a25ff0e34fb87339ba5e13eca17cec00f)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241002/202410021015.OHF2CJsc-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202410021015.OHF2CJsc-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from drivers/iommu/arm/arm-smmu/arm-smmu.c:20:
   In file included from include/linux/acpi.h:14:
   In file included from include/linux/device.h:32:
   In file included from include/linux/device/driver.h:21:
   In file included from include/linux/module.h:19:
   In file included from include/linux/elf.h:6:
   In file included from arch/s390/include/asm/elf.h:181:
   In file included from arch/s390/include/asm/mmu_context.h:11:
   In file included from arch/s390/include/asm/pgalloc.h:18:
   In file included from include/linux/mm.h:2228:
   include/linux/vmstat.h:503:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
     503 |         return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~ ^
     504 |                            item];
         |                            ~~~~
   include/linux/vmstat.h:510:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
     510 |         return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~ ^
     511 |                            NR_VM_NUMA_EVENT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~~
   include/linux/vmstat.h:517:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
     517 |         return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
         |                               ~~~~~~~~~~~ ^ ~~~
   include/linux/vmstat.h:523:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
     523 |         return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~ ^
     524 |                            NR_VM_NUMA_EVENT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~~
   In file included from drivers/iommu/arm/arm-smmu/arm-smmu.c:24:
   In file included from include/linux/dma-mapping.h:11:
   In file included from include/linux/scatterlist.h:9:
   In file included from arch/s390/include/asm/io.h:93:
   include/asm-generic/io.h:548:31: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     548 |         val = __raw_readb(PCI_IOBASE + addr);
         |                           ~~~~~~~~~~ ^
   include/asm-generic/io.h:561:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     561 |         val = __le16_to_cpu((__le16 __force)__raw_readw(PCI_IOBASE + addr));
         |                                                         ~~~~~~~~~~ ^
   include/uapi/linux/byteorder/big_endian.h:37:59: note: expanded from macro '__le16_to_cpu'
      37 | #define __le16_to_cpu(x) __swab16((__force __u16)(__le16)(x))
         |                                                           ^
   include/uapi/linux/swab.h:102:54: note: expanded from macro '__swab16'
     102 | #define __swab16(x) (__u16)__builtin_bswap16((__u16)(x))
         |                                                      ^
   In file included from drivers/iommu/arm/arm-smmu/arm-smmu.c:24:
   In file included from include/linux/dma-mapping.h:11:
   In file included from include/linux/scatterlist.h:9:
   In file included from arch/s390/include/asm/io.h:93:
   include/asm-generic/io.h:574:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     574 |         val = __le32_to_cpu((__le32 __force)__raw_readl(PCI_IOBASE + addr));
         |                                                         ~~~~~~~~~~ ^
   include/uapi/linux/byteorder/big_endian.h:35:59: note: expanded from macro '__le32_to_cpu'
      35 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
         |                                                           ^
   include/uapi/linux/swab.h:115:54: note: expanded from macro '__swab32'
     115 | #define __swab32(x) (__u32)__builtin_bswap32((__u32)(x))
         |                                                      ^
   In file included from drivers/iommu/arm/arm-smmu/arm-smmu.c:24:
   In file included from include/linux/dma-mapping.h:11:
   In file included from include/linux/scatterlist.h:9:
   In file included from arch/s390/include/asm/io.h:93:
   include/asm-generic/io.h:585:33: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     585 |         __raw_writeb(value, PCI_IOBASE + addr);
         |                             ~~~~~~~~~~ ^
   include/asm-generic/io.h:595:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     595 |         __raw_writew((u16 __force)cpu_to_le16(value), PCI_IOBASE + addr);
         |                                                       ~~~~~~~~~~ ^
   include/asm-generic/io.h:605:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     605 |         __raw_writel((u32 __force)cpu_to_le32(value), PCI_IOBASE + addr);
         |                                                       ~~~~~~~~~~ ^
   include/asm-generic/io.h:693:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     693 |         readsb(PCI_IOBASE + addr, buffer, count);
         |                ~~~~~~~~~~ ^
   include/asm-generic/io.h:701:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     701 |         readsw(PCI_IOBASE + addr, buffer, count);
         |                ~~~~~~~~~~ ^
   include/asm-generic/io.h:709:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     709 |         readsl(PCI_IOBASE + addr, buffer, count);
         |                ~~~~~~~~~~ ^
   include/asm-generic/io.h:718:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     718 |         writesb(PCI_IOBASE + addr, buffer, count);
         |                 ~~~~~~~~~~ ^
   include/asm-generic/io.h:727:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     727 |         writesw(PCI_IOBASE + addr, buffer, count);
         |                 ~~~~~~~~~~ ^
   include/asm-generic/io.h:736:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     736 |         writesl(PCI_IOBASE + addr, buffer, count);
         |                 ~~~~~~~~~~ ^
>> drivers/iommu/arm/arm-smmu/arm-smmu.c:1441:11: error: incompatible integer to pointer conversion returning 'int' from a function with result type 'struct iommu_device *' [-Wint-conversion]
    1441 |                         return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
         |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   16 warnings and 1 error generated.


vim +1441 drivers/iommu/arm/arm-smmu/arm-smmu.c

  1419	
  1420	static struct iommu_device *arm_smmu_probe_device(struct device *dev)
  1421	{
  1422		struct arm_smmu_device *smmu = NULL;
  1423		struct arm_smmu_master_cfg *cfg;
  1424		struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
  1425		int i, ret;
  1426	
  1427		if (using_legacy_binding) {
  1428			ret = arm_smmu_register_legacy_master(dev, &smmu);
  1429	
  1430			/*
  1431			 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
  1432			 * will allocate/initialise a new one. Thus we need to update fwspec for
  1433			 * later use.
  1434			 */
  1435			fwspec = dev_iommu_fwspec_get(dev);
  1436			if (ret)
  1437				goto out_free;
  1438		} else {
  1439			smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);
  1440			if (!smmu)
> 1441				return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
  1442		}
  1443	
  1444		ret = -EINVAL;
  1445		for (i = 0; i < fwspec->num_ids; i++) {
  1446			u16 sid = FIELD_GET(ARM_SMMU_SMR_ID, fwspec->ids[i]);
  1447			u16 mask = FIELD_GET(ARM_SMMU_SMR_MASK, fwspec->ids[i]);
  1448	
  1449			if (sid & ~smmu->streamid_mask) {
  1450				dev_err(dev, "stream ID 0x%x out of range for SMMU (0x%x)\n",
  1451					sid, smmu->streamid_mask);
  1452				goto out_free;
  1453			}
  1454			if (mask & ~smmu->smr_mask_mask) {
  1455				dev_err(dev, "SMR mask 0x%x out of range for SMMU (0x%x)\n",
  1456					mask, smmu->smr_mask_mask);
  1457				goto out_free;
  1458			}
  1459		}
  1460	
  1461		ret = -ENOMEM;
  1462		cfg = kzalloc(offsetof(struct arm_smmu_master_cfg, smendx[i]),
  1463			      GFP_KERNEL);
  1464		if (!cfg)
  1465			goto out_free;
  1466	
  1467		cfg->smmu = smmu;
  1468		dev_iommu_priv_set(dev, cfg);
  1469		while (i--)
  1470			cfg->smendx[i] = INVALID_SMENDX;
  1471	
  1472		ret = arm_smmu_rpm_get(smmu);
  1473		if (ret < 0)
  1474			goto out_cfg_free;
  1475	
  1476		ret = arm_smmu_master_alloc_smes(dev);
  1477		arm_smmu_rpm_put(smmu);
  1478	
  1479		if (ret)
  1480			goto out_cfg_free;
  1481	
  1482		device_link_add(dev, smmu->dev,
  1483				DL_FLAG_PM_RUNTIME | DL_FLAG_AUTOREMOVE_SUPPLIER);
  1484	
  1485		return &smmu->iommu;
  1486	
  1487	out_cfg_free:
  1488		kfree(cfg);
  1489	out_free:
  1490		iommu_fwspec_free(dev);
  1491		return ERR_PTR(ret);
  1492	}
  1493
diff mbox series

Patch

diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c
index 723273440c21..1f2bafa92f1f 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c
@@ -1437,6 +1437,8 @@  static struct iommu_device *arm_smmu_probe_device(struct device *dev)
 			goto out_free;
 	} else {
 		smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);
+		if (!smmu)
+			return dev_err_probe(dev, -EPROBE_DEFER, "smmu dev has not bound yet\n");
 	}
 
 	ret = -EINVAL;