iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group

Currently, mtk_iommu calls during probe iommu_device_register before
the hw_list from driver data is initialized. Since iommu probing issue
fix, it leads to NULL pointer dereference in mtk_iommu_device_group when
hw_list is accessed with list_first_entry (not null safe).

So, change the call order to ensure iommu_device_register is called
after the driver data are initialized.

Fixes: 9e3a2a643653 ("iommu/mediatek: Adapt sharing and non-sharing pgtable case")
Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path")
Reviewed-by: Yong Wu <yong.wu@mediatek.com>
Tested-by: Chen-Yu Tsai <wenst@chromium.org> # MT8183 Juniper, MT8186 Tentacruel
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Link: https://lore.kernel.org/r/20250403-fix-mtk-iommu-error-v2-1-fe8b18f8b0a8@collabora.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>

diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index 034b0e670384a24df10130cbbff95ce8e0bc092d..df98d0c65f5469c6803cd9d151c85ad855558cf5 100644 (file)
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -1372,15 +1372,6 @@ static int mtk_iommu_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, data);
        mutex_init(&data->mutex);
 
-       ret = iommu_device_sysfs_add(&data->iommu, dev, NULL,
-                                    "mtk-iommu.%pa", &ioaddr);
-       if (ret)
-               goto out_link_remove;
-
-       ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);
-       if (ret)
-               goto out_sysfs_remove;
-
        if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE)) {
                list_add_tail(&data->list, data->plat_data->hw_list);
                data->hw_list = data->plat_data->hw_list;
@@ -1390,19 +1381,28 @@ static int mtk_iommu_probe(struct platform_device *pdev)
                data->hw_list = &data->hw_list_head;
        }
 
+       ret = iommu_device_sysfs_add(&data->iommu, dev, NULL,
+                                    "mtk-iommu.%pa", &ioaddr);
+       if (ret)
+               goto out_list_del;
+
+       ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);
+       if (ret)
+               goto out_sysfs_remove;
+
        if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) {
                ret = component_master_add_with_match(dev, &mtk_iommu_com_ops, match);
                if (ret)
-                       goto out_list_del;
+                       goto out_device_unregister;
        }
        return ret;
 
-out_list_del:
-       list_del(&data->list);
+out_device_unregister:
        iommu_device_unregister(&data->iommu);
 out_sysfs_remove:
        iommu_device_sysfs_remove(&data->iommu);
-out_link_remove:
+out_list_del:
+       list_del(&data->list);
        if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM))
                device_link_remove(data->smicomm_dev, dev);
 out_runtime_disable: