From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59EEA29BD90; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=gtsGUGlYCbu4oG8cCHZzyF4oqcYgIGcc9xsZGMEnra7j+cE5mDzkXMQ3na9rgyjXZLbJ1n6/EmQdd6qfksaZD2DgEwc/4gWghsp2l7pk/SUKc+41TySUtdn8+iUcf/Cm4/yl8ILpCYNO/ykPV6uSUUk99eclZg40n41avTJv2Dk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=zphBEhYRgWZAxroiGCHNYyuNwE4bWqDyjlGgmN4zMeM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Sg0Ia8jOl5gu11FMsAW+dzhzor3FCBgIel7Iy0Xt1tha+Lyn4NhZZEEa2tkfrGEDpcLBseafw+f6J64DJch8pcwSonmbMVRwePFpLaK+GB5f22zMmN7fqv5knuZd3TNg6UpOo7lZgx0i+84nkjnDhyEV3yEJe9+DDI5OlY3xbGA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gUa6eCTI; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gUa6eCTI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0AAABC4CEFB; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=zphBEhYRgWZAxroiGCHNYyuNwE4bWqDyjlGgmN4zMeM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gUa6eCTIBwfS4ltnJk8WDLY2NvmFlqgOIL6Fo9omcbSKVUxkbgYSRttT+E8SFnxS9 ZeBzTk4RvxUvdek0JivuHRFjvCNkcAy/NXnUHKBte1yaYvwmC2iS9p7c1O89Y+DQUc l5zxf2OWSdRCt4Z8+vwzx9sarRR8CfPTKp37oNx7I9wyriW2PkCsfrL6lKHFFORLYI X3vTim9RXMUB5G39SyJ6jREn4JZ5OrEieJh00wBbleZYKyp9MuJm8kXxEPdupiF2Kx id2gpeIRM8BXQBuSo9A7wyxUmtdIG288UolXjJLmsfg8CTVpFYHAeSaMSS09f7G53x hIlvBu11ZjBrg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwm-00000000831-3MyP; Mon, 20 Oct 2025 06:56:40 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v3 01/14] iommu/apple-dart: fix device leak on of_xlate() Date: Mon, 20 Oct 2025 06:53:05 +0200 Message-ID: <20251020045318.30690-2-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 46d1fb072e76 ("iommu/dart: Add DART iommu driver") Cc: stable@vger.kernel.org # 5.15 Cc: Sven Peter Acked-by: Robin Murphy Signed-off-by: Johan Hovold --- drivers/iommu/apple-dart.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c index 95a4e62b8f63..9804022c7f59 100644 --- a/drivers/iommu/apple-dart.c +++ b/drivers/iommu/apple-dart.c @@ -802,6 +802,8 @@ static int apple_dart_of_xlate(struct device *dev, struct apple_dart *cfg_dart; int i, sid; =20 + put_device(&iommu_pdev->dev); + if (args->args_count !=3D 1) return -EINVAL; sid =3D args->args[0]; --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78A2A2C0278; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=h+fT7znlSx746nMuQmVwC69MOJiSnHOeuf+HBpBeVwmTSuJutfmVPXDbcMkGWqXJeN92vlgRe3u25fS8KGru84m4WFMUaDquY3zBF6+wGdIVU1ohsitFCV/wGJeOCh8b9TeaDEPywtT1ioOzoyzoqD9wS8JlLpYUfkLAcx4G2ic= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=oLg6WHZ3aWKPMgrdsNiH4CTRs3dtYtjw8ulmKtz/VGk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=O6MbLKcI4BzJuqga++85ttSlftOaETFMxyi/r7Kgpa4WrqR7Ln3urh8a63jllUwC/Q/pewJPglja8pAtFx0edAjn8es8rwF/ywDNaAZv2kcxF3HBlZeBD4hWmKCKyC0TU+WbuZhyEmXmE7ZiWbcyfQ+rbLM3Va/0E/R894bZ2DM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IfXi8Mzk; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IfXi8Mzk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26AF5C116C6; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=oLg6WHZ3aWKPMgrdsNiH4CTRs3dtYtjw8ulmKtz/VGk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IfXi8MzkFkrnoX55/gJrRe9WDImh+XSAdZFrqDh3FsgpzgQifmLU2xHahw+zvizq6 1JiNbX8Vb2zNCsbEudJ7uxTkbOTCnMa0kKM0iiLHw6rhzdR7NHulVLp6XYnbA0SspR A7OgzGXv1OxmmzlLfrYHl5syODf0d28OJGKFNqmt3A8CizdrQEqj+DxQDHgyZmH0C7 jlsBsQnou/1LJC2S9/RhxX485cR4WMR64ZmOBqn2yiva+EP6Cm+LpAPuz/ptL9vWon quvL2hTALH0WDVDUKjZAS2X3c7da3h7Xqa+l/CJfByzz5P5EnSWLAE/NBX2PU8S0eO VdXqZ+lVlCnYA== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwm-00000000833-3mu7; Mon, 20 Oct 2025 06:56:40 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Yu Kuai Subject: [PATCH v3 02/14] iommu/qcom: fix device leak on of_xlate() Date: Mon, 20 Oct 2025 06:53:06 +0200 Message-ID: <20251020045318.30690-3-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Note that commit e2eae09939a8 ("iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success and late failures. Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu") Cc: stable@vger.kernel.org # 4.14: e2eae09939a8 Cc: Rob Clark Cc: Yu Kuai Acked-by: Robin Murphy Signed-off-by: Johan Hovold --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/ar= m-smmu/qcom_iommu.c index c5be95e56031..9c1166a3af6c 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -565,14 +565,14 @@ static int qcom_iommu_of_xlate(struct device *dev, =20 qcom_iommu =3D platform_get_drvdata(iommu_pdev); =20 + put_device(&iommu_pdev->dev); + /* make sure the asid specified in dt is valid, so we don't have * to sanity check this elsewhere: */ if (WARN_ON(asid > qcom_iommu->max_asid) || - WARN_ON(qcom_iommu->ctxs[asid] =3D=3D NULL)) { - put_device(&iommu_pdev->dev); + WARN_ON(qcom_iommu->ctxs[asid] =3D=3D NULL)) return -EINVAL; - } =20 if (!dev_iommu_priv_get(dev)) { dev_iommu_priv_set(dev, qcom_iommu); @@ -581,10 +581,8 @@ static int qcom_iommu_of_xlate(struct device *dev, * multiple different iommu devices. Multiple context * banks are ok, but multiple devices are not: */ - if (WARN_ON(qcom_iommu !=3D dev_iommu_priv_get(dev))) { - put_device(&iommu_pdev->dev); + if (WARN_ON(qcom_iommu !=3D dev_iommu_priv_get(dev))) return -EINVAL; - } } =20 return iommu_fwspec_add_ids(dev, &asid, 1); --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 766622C026A; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=fmsD5MxySb5dgH/Bg5Rooh5ED209IhvxQRoglBHyoI8kq/MO82JpzVL7sSUduiP/S+OxzBWj0KlrrRGjyNrrNXQrIEAP4QVjR0CS6d13y92g+Wpn1Z0PusarKSecOTXY75eHRMr+HVFh67nHBIdLCjuxyxec0QwRYufh5knpnXU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=r9qtk/zGzPX4aPYztAqcO0jnG1letB1R7xNmRkHttgM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QNGYPS+oc5NU5ruPqWGie2AqIM0+fPaytSBCuS/IqaMfb7TdC2nuvp/ZbsKxP8TosJ7lPi0PET5k1cBWJQ27QSLfBaqtKRcwowQY8hNr1kuCrrjShhFsUlUsf1zplbb5TrmmjGeO7pECohU1TLCwx7bQ1D7MHxM0jIOKpapazCA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CsXsSPqR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CsXsSPqR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 25A47C16AAE; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=r9qtk/zGzPX4aPYztAqcO0jnG1letB1R7xNmRkHttgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CsXsSPqR4/uGaj51CAzk6fPYMGPxWJVS+rHIPqDdnu3Is9J2BjUJgsFY3/ileZNu+ Bl2lOQnZNTWtA+0rZy20KmAK9p7wz4LffAwBI8JYHlryW3Lbzdh2YhAYLVAkAwefWx cze8yrnZOMrndcepMG8UC2AGSXjI9YxwPJSx1rkUof/YoPttfOI8GG1kCBZhzDN4OX DuIOX6xlQduq2DUe+wABEE8wX9ZGNGqycWC1oKQe1gNNPM/wWpQRdX7JBqoLbz+iEt pYxArjd0ZeELhN3o8saaMeCTpIymnmgQNtCp4CwEjrUlXBPfG0AP91430icrNmFRZ5 mrR4if8Zm0egQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-00000000835-00sN; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Yu Kuai Subject: [PATCH v3 03/14] iommu/exynos: fix device leak on of_xlate() Date: Mon, 20 Oct 2025 06:53:07 +0200 Message-ID: <20251020045318.30690-4-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Note that commit 1a26044954a6 ("iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success. Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices f= rom device tree") Cc: stable@vger.kernel.org # 4.2: 1a26044954a6 Cc: Yu Kuai Acked-by: Robin Murphy Acked-by: Marek Szyprowski Signed-off-by: Johan Hovold --- drivers/iommu/exynos-iommu.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c index b6edd178fe25..ce9e935cb84c 100644 --- a/drivers/iommu/exynos-iommu.c +++ b/drivers/iommu/exynos-iommu.c @@ -1446,17 +1446,14 @@ static int exynos_iommu_of_xlate(struct device *dev, return -ENODEV; =20 data =3D platform_get_drvdata(sysmmu); - if (!data) { - put_device(&sysmmu->dev); + put_device(&sysmmu->dev); + if (!data) return -ENODEV; - } =20 if (!owner) { owner =3D kzalloc(sizeof(*owner), GFP_KERNEL); - if (!owner) { - put_device(&sysmmu->dev); + if (!owner) return -ENOMEM; - } =20 INIT_LIST_HEAD(&owner->controllers); mutex_init(&owner->rpm_lock); --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA3E62C0F7D; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=k5xVFzzeHS896EsjD0XIH5ZW0j8jbfdyGjDbOX9KPLO0dbOqezvEh9rX6ZOtzHxfiXMM99Yu7+sQrrvsYac0Iz6OstngWXq71Zx2rBYEcbziY4vjHGK71Upps1Blqk1H49vMvqsWByF710Vy0lpdzGMeV8r6JBM77DLKYekxqZ0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=VGVPMHZfJFWJ065a5fqtHiZF8kLqRFAbyAg8TzOuAcA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I2zfzF0GE8VzPdEdM6HSSE5YXESac/9xrHzXNFgX35YSV6KFvoWzFCq7VrnCZNOHFKSyuJ7dIKw8k+GxETwFjGf5lb20ReukkbdMRBhnMEmta6tqYR5wIKDHKsgBpVrHZztZV+nF3WF+cjPgrW5P8NLXgq+Hl6XJQ00lBYIcUtE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mzj7gL0p; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mzj7gL0p" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C83FC19422; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=VGVPMHZfJFWJ065a5fqtHiZF8kLqRFAbyAg8TzOuAcA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mzj7gL0pivU/EfTA7H3gg6z7TV+Je+RM6IUzJNqfokHkifgWMT0Nh5U89DaLg5VUS 3x5yU/uM1PYFUf23YtkrhKBWtDfNiXZxOrAjqzxxPK7zHl3YSYpidchv4gH0eZF91G TMRUB2TdeQLEGMmOQBQggW7tvgyqoWXcAFnHQQ23M/DVCr54dm8SoAD+Txv5eQqoKV lAdBq5PDA8XY3jtOSSiG4txlzGdUiaVXE/5xjErpXCjGq6P99OazHFuoKSv2mmdnMq sNot9LOm3x9Jm1r9ynD/wKjMmVVwjKykdhXE2+qBUZSmlZhqAd8Va1WvkTNmzozeTK iVA34TYuYVEOw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-00000000837-0X2N; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Magnus Damm Subject: [PATCH v3 04/14] iommu/ipmmu-vmsa: fix device leak on of_xlate() Date: Mon, 20 Oct 2025 06:53:08 +0200 Message-ID: <20251020045318.30690-5-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 7b2d59611fef ("iommu/ipmmu-vmsa: Replace local utlb code with fwspec= ids") Cc: stable@vger.kernel.org # 4.14 Cc: Magnus Damm Acked-by: Robin Murphy Signed-off-by: Johan Hovold --- drivers/iommu/ipmmu-vmsa.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c index ffa892f65714..02a2a55ffa0a 100644 --- a/drivers/iommu/ipmmu-vmsa.c +++ b/drivers/iommu/ipmmu-vmsa.c @@ -720,6 +720,8 @@ static int ipmmu_init_platform_device(struct device *de= v, =20 dev_iommu_priv_set(dev, platform_get_drvdata(ipmmu_pdev)); =20 + put_device(&ipmmu_pdev->dev); + return 0; } =20 --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7203F2C0266; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=iiD5NyXzpP//fvT0r49l7QA6x+JuwWdKzL2d3m9/npnPlSAs88M+AHpPHPPUdRBINZ5RV03HCCLQCZ35hK/HuKOO8GH7za01EG71wqoUTCVd14NcrslhtNoTkOf+SzIHrXT3kfzzILdsbYOutlHJ/X7Gyooh4UghX6Dru0lOyJQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=FyWhY5bdBhnBjSs0edv55LlddyoKr6zkeQMAkUftQ70=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a+JmbbjSI+ZydRnYD/EvXKxRO+aLFm+JIShc410TB8n56IzHWnU+qJ5NGexS2xCIu7s4Cqkaayw1VjX8GImFBLRSV50G8hjyJRxIrJudbou46hFD4ajibfeoHPLVwD9mKnMPxSNunQed4yAowyMUfKimE04Kgrx0vduMn0v6u+g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NbNsoq84; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NbNsoq84" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 359C5C19421; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=FyWhY5bdBhnBjSs0edv55LlddyoKr6zkeQMAkUftQ70=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NbNsoq84dyjFRgMtcA96mVS3b2XBf/pIlooEgaFs7+3i3Js3NvAioIrM2QRxCIlP1 /DOGUZbzxwJ4KKeBhXqDDv4JiyyEjq0GB2z7WpCYzWXXz9Rf1H0NvQD5PFEHPiYQyD imxXO+6wv/dj6NmQv0NGW9LGXYGFGtzX91pvNr3c05Uy/onWLbKggp6mymu+e8OROV VT6RlQiMHAItRzYMwbcqZBc9vNeMdGnTJynywE2hPYur8MMwPNkeXm4hxe3+42Fvu5 hc9U1b4dykspZiNE1Ca0cI2qIn9gHGir7D/03Ln7dzDP6PSuOd6LSN6dUCTugJ+1IK U9bBDOJbtYpcA== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083B-0zoc; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v3 05/14] iommu/mediatek: fix device leak on of_xlate() Date: Mon, 20 Oct 2025 06:53:09 +0200 Message-ID: <20251020045318.30690-6-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 0df4fabe208d ("iommu/mediatek: Add mt8173 IOMMU driver") Cc: stable@vger.kernel.org # 4.6 Acked-by: Robin Murphy Reviewed-by: Yong Wu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno --- drivers/iommu/mtk_iommu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 0e0285348d2b..8d8e85186188 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -974,6 +974,8 @@ static int mtk_iommu_of_xlate(struct device *dev, return -EINVAL; =20 dev_iommu_priv_set(dev, platform_get_drvdata(m4updev)); + + put_device(&m4updev->dev); } =20 return iommu_fwspec_add_ids(dev, args->args, 1); --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E25BD2C21CB; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; cv=none; b=kPcmAzGcA5WRvVNAUNo6bje0zyWr7P2BFNM4zeox5HRV4k5oO9zKs+rNK5eQBzSJlWqtcN/3TvjqmFblRBlhrjdGQZDCLorM6kA+5n+ZV1RDIxe3oAuRVxGT0VZKMlJmoniAwqqfkzHl+BGBRX5PhWtDLmOw5n5RUVLONvvyhhY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; c=relaxed/simple; bh=Uphrj0V5NRAywmcIq5nn1A5c0/bedTfijWA5afzFZQQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CL3ODAncQUQvcNiskGFBqcBUIkwdheQNcFc9CAUSBrDZYnoDkIUE09VOtI3WHPT1kgstuftR8hPpNhjEzaLIj4wltm/HWOPvKW5mr6xdYDr4p4iNPp342a/Ma907oItb1n+WsGq7YFSvOHG/i9Nsi2W3tQZ9F7JsFJOut09iMRQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=AgyEXD31; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="AgyEXD31" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F83AC4CEF9; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=Uphrj0V5NRAywmcIq5nn1A5c0/bedTfijWA5afzFZQQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AgyEXD314z4HElDhu3YoDBwzu1iw1JHxcAKLKio+3ERYoaB1Ytuqj9GzdQPbnR2b0 F9DqV2Cm0YTMCkpf4m9Tc9fPsvJos1ZFL+3bJnms9S5HNnDS6bxfogaD+AUXefiSm+ OEZcpEHs6awyC1rR8gO8nv3lBeNl+vFovfJwDV/Lgen+WQQ/icrdGenmgvPtm28N8A z28Zok+VprM1o4+eEunK5kw71JGERnWdc+tOnO+i0+HuugikCOyXRinvMkpqUYbrgJ qHXxsR1HytNykp38kH4KltHZt/UUKLOeaF7PrspdcCj63tgv8pNnF3/K6Wt1dv4z/n 2eZ675hcJ4yfg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083E-1NA6; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v3 06/14] iommu/mediatek: fix use-after-free on probe deferral Date: Mon, 20 Oct 2025 06:53:10 +0200 Message-ID: <20251020045318.30690-7-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound. Fixes: 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_par= se") Cc: stable@vger.kernel.org Cc: Yong Wu Acked-by: Robin Murphy Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 8d8e85186188..64ce041238fd 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1213,16 +1213,19 @@ static int mtk_iommu_mm_dts_parse(struct device *de= v, struct component_match **m } =20 component_match_add(dev, match, component_compare_dev, &plarbdev->dev); - platform_device_put(plarbdev); } =20 - if (!frst_avail_smicomm_node) - return -EINVAL; + if (!frst_avail_smicomm_node) { + ret =3D -EINVAL; + goto err_larbdev_put; + } =20 pcommdev =3D of_find_device_by_node(frst_avail_smicomm_node); of_node_put(frst_avail_smicomm_node); - if (!pcommdev) - return -ENODEV; + if (!pcommdev) { + ret =3D -ENODEV; + goto err_larbdev_put; + } data->smicomm_dev =3D &pcommdev->dev; =20 link =3D device_link_add(data->smicomm_dev, dev, @@ -1230,7 +1233,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev,= struct component_match **m platform_device_put(pcommdev); if (!link) { dev_err(dev, "Unable to link %s.\n", dev_name(data->smicomm_dev)); - return -EINVAL; + ret =3D -EINVAL; + goto err_larbdev_put; } return 0; =20 @@ -1402,8 +1406,12 @@ static int mtk_iommu_probe(struct platform_device *p= dev) iommu_device_sysfs_remove(&data->iommu); out_list_del: list_del(&data->list); - if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) + if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) { device_link_remove(data->smicomm_dev, dev); + + for (i =3D 0; i < MTK_LARB_NR_MAX; i++) + put_device(data->larb_imu[i].dev); + } out_runtime_disable: pm_runtime_disable(dev); return ret; @@ -1423,6 +1431,9 @@ static void mtk_iommu_remove(struct platform_device *= pdev) if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) { device_link_remove(data->smicomm_dev, &pdev->dev); component_master_del(&pdev->dev, &mtk_iommu_com_ops); + + for (i =3D 0; i < MTK_LARB_NR_MAX; i++) + put_device(data->larb_imu[i].dev); } pm_runtime_disable(&pdev->dev); for (i =3D 0; i < data->plat_data->banks_num; i++) { --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88D012C0298; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=oDQkzrzssWQvlvL/LO0u/eKgcz3QXmLD1VxVxBBukIHoVepVqrvtmtPUq9tfv65TkpwBzFKG9e32gdamqpj8BHdmvrzqdyoAiQJlsFTjavloOsbv73Hl+iRuU9ZCehELfPdirlbAA2v4lOsni1+6sQu1XeyANh/DQcVnY7Wfcj0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=tHVRW+tk17pqNuK7fYLET2iKWngthkKfcRRhifSxTno=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cgkG79yYfq1bsM/DCbYLV4II1XObR6OnjsmfoLlhHHZu4+1vh9Po0WDWNq4lgtzrWpKzjWlLU1wUogYqeicRDP1snCquweWJmbLmoGzuT2w4M4GE6ZFW7dQUhSRiGVEbpR2fVp84cGY4LM4eVQebybCMPQ2GJts/IU9XPm6kONY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZXBdEOqu; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZXBdEOqu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C284C2BC86; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=tHVRW+tk17pqNuK7fYLET2iKWngthkKfcRRhifSxTno=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZXBdEOqu3tnm+H6MAvaIx5y1l0QxcloLJo4N3Rlhrmiskno3wm+L2UQIeMwA/yfp6 YxYjgZ16wIh2RYxjCzrcoERJPlhdaKcpsEsOE+Yo5lywqw9zVU3Sh9T3kSxFLn4SRr 5gnGdyaZmdMmpnL3LqJ5oYtm1SQC5pF3ZZINNU+6W8u6xZtviGg7x5jTMYEkroxATT CLKBSuE9wvUQSdby/rgPZmGdSm3w1fSRDeqwjGhpXt4cIOPKXMem7AiA0pwKyNupry 6jf3uOqLwZflolsk4ZN+fxVpIhrlYX+kZWHqPKxgAq/ts3B26CDV176xLLT1dpqtpy a6tz8k0zWksOw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083G-1hfX; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 07/14] iommu/mediatek: simplify dt parsing error handling Date: Mon, 20 Oct 2025 06:53:11 +0200 Message-ID: <20251020045318.30690-8-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" As previously documented by commit 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse"), the id mapping may not be linear so the whole larb array needs to be iterated on devicetree parsing errors. Simplify the loop by iterating from index zero while dropping the redundant NULL check for consistency with later cleanups. Also add back the comment which was removed by commit 462e768b55a2 ("iommu/mediatek: Fix forever loop in error handling") to prevent anyone from trying to optimise the loop by iterating backwards from 'i'. Cc: Yong Wu Acked-by: Robin Murphy Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 64ce041238fd..f21cd3766069 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1239,11 +1239,10 @@ static int mtk_iommu_mm_dts_parse(struct device *de= v, struct component_match **m return 0; =20 err_larbdev_put: - for (i =3D MTK_LARB_NR_MAX - 1; i >=3D 0; i--) { - if (!data->larb_imu[i].dev) - continue; + /* id mapping may not be linear, loop the whole array */ + for (i =3D 0; i < MTK_LARB_NR_MAX; i++) put_device(data->larb_imu[i].dev); - } + return ret; } =20 --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1C0C2C0F6D; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=dqs+7ITfRvVglawkV9SXw7OTh4YTJSsXtU1Fo8lX5/9IT90QsPzI5BZ5FNZP/9hSHhbeVjcmYmAtJsdVVSaxeqifotFyGBCKAxnJdF5QPiifExOXxFdxcjAgtaNLKVopaKfij53bcmpYV+rlv/pu5DzbF1NR7guMgHvRTA9zAts= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=Vs3JXMHA2JEN80dOAChSfBFVZoS2PQMeJrgOF/SbKA0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Aj38BqlOvEx9IuQR6AC/OEgiixw1WM8nK+ocZ9a1Rp6mclLgOoUg9swAZYRKzvtlqh6DPg/bpX7gcPzogddV5ItC3zk1wx1bj9yHrkqXLxghyjF9afpFJrjbrUMIhRniitnrqtiOy9tXC6svMxpTm1v5h1uXh0nBseEyu17Sh/4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Agze4Khb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Agze4Khb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7769BC19424; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=Vs3JXMHA2JEN80dOAChSfBFVZoS2PQMeJrgOF/SbKA0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Agze4Khb9TZRD9HcFWiVIswGbHx6PwWVM6QOeLZdAUlH7K4HF4Ib94GrJfb4sLKfP zPThsumbAEkrSo0h8V6Wi0XyC8qqjhZr5L+l9WfI28pwTBXlVo11MkpKM2vtsqWpLf 07X2eAT6Rvtv1WwqiZc+SCbv1vLsCFo92oA2FV0yiGN2TJXWU2jeSGm2VGsqlaoftr Pu02do99WfoGfsx5iPPTukJM9kyfFjA/k91btFRBpDvve3pyczRWkBGG6Zohi1S4Lq IAVr636PgNp5YiNx0pM89GH1DPOPD48LtvfrExvE3mhewla+IExLDb3qeYyjJH5dFl /8rZJUXGW22Cw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083J-22AS; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Honghui Zhang Subject: [PATCH v3 08/14] iommu/mediatek-v1: fix device leak on probe_device() Date: Mon, 20 Oct 2025 06:53:12 +0200 Message-ID: <20251020045318.30690-9-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device(). Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation = one HW") Cc: stable@vger.kernel.org # 4.8 Cc: Honghui Zhang Acked-by: Robin Murphy Reviewed-by: Yong Wu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno --- drivers/iommu/mtk_iommu_v1.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c index 10cc0b1197e8..de9153c0a82f 100644 --- a/drivers/iommu/mtk_iommu_v1.c +++ b/drivers/iommu/mtk_iommu_v1.c @@ -435,6 +435,8 @@ static int mtk_iommu_v1_create_mapping(struct device *d= ev, return -EINVAL; =20 dev_iommu_priv_set(dev, platform_get_drvdata(m4updev)); + + put_device(&m4updev->dev); } =20 ret =3D iommu_fwspec_add_ids(dev, args->args, 1); --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B13842C0F92; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; cv=none; b=hR7U0w40fLxIy1+Ug5Qvr7OClmKqTNwo/gmlhXF70UVvH+uEZg/akHRonjO8CmpLmGnMPhxFcF/odigzPrID4Utf3WP/ubXnhge4RmSxJ7Mhz7RFbcoIl6oewoqYZL/GSaMDfjpWYarxF19d5ADg07t3AN7oSu7IvQY4frb9Yks= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936197; c=relaxed/simple; bh=4nJz45e/2tb3rsqBi1FGg7jxKLaVlWYuDQzcHcXUw2U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GcovDCMKIL0xc+ALP5blHDDw2ihYTZmSl1aFMovujV+oJDOoTQTtgkX5q+NkpDoxfMYvKeueNaEXqdEE/jEZgiolqcaTYAwn1xa7l51wYyJg4qPPTZTPfyksExdjQVCdT/bdAIOWaAfkZNWr/3vPPZ0aG07fumDtgh+JTypLpqc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QMVW3WAC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QMVW3WAC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BDA7C4CEFB; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=4nJz45e/2tb3rsqBi1FGg7jxKLaVlWYuDQzcHcXUw2U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QMVW3WACgvVpiecGOj9ZfELxTZ08BJCPHoAGgS3nNQZ988hWxlg/+v5hyYs7+Z7Cx 1mEkxTTA8iUoGSMYNdVY2GX8S6PAE8VI8QQZZMMFd7BmEsWEwDZBnwOEJC6GSSLRNP Lk4jsQcheR2gmt9QghskgqRvLmIzh5OwWRRcf7WkUdwESNp9cHi3DxEoTbEuDvihht F1ztnNNFYIiwE7g4gv3WigO+q4vWM8hJvSJWkanZdlmfj2tP2xabfz73q/WaCe2Q2C 6nvRPIU1xloyBRj51CFgbXOkcLKaQiGdGf0vOTxaCmRDm4gZzWdiGTNgimFRmUVlFG 7fPfxDhxd+XDQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083M-2SGu; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Honghui Zhang Subject: [PATCH v3 09/14] iommu/mediatek-v1: fix device leaks on probe() Date: Mon, 20 Oct 2025 06:53:13 +0200 Message-ID: <20251020045318.30690-10-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the references taken to the larb devices during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation = one HW") Cc: stable@vger.kernel.org # 4.8 Cc: Honghui Zhang Acked-by: Robin Murphy Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno --- drivers/iommu/mtk_iommu_v1.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c index de9153c0a82f..44b965a2db92 100644 --- a/drivers/iommu/mtk_iommu_v1.c +++ b/drivers/iommu/mtk_iommu_v1.c @@ -648,8 +648,10 @@ static int mtk_iommu_v1_probe(struct platform_device *= pdev) struct platform_device *plarbdev; =20 larbnode =3D of_parse_phandle(dev->of_node, "mediatek,larbs", i); - if (!larbnode) - return -EINVAL; + if (!larbnode) { + ret =3D -EINVAL; + goto out_put_larbs; + } =20 if (!of_device_is_available(larbnode)) { of_node_put(larbnode); @@ -659,11 +661,14 @@ static int mtk_iommu_v1_probe(struct platform_device = *pdev) plarbdev =3D of_find_device_by_node(larbnode); if (!plarbdev) { of_node_put(larbnode); - return -ENODEV; + ret =3D -ENODEV; + goto out_put_larbs; } if (!plarbdev->dev.driver) { of_node_put(larbnode); - return -EPROBE_DEFER; + put_device(&plarbdev->dev); + ret =3D -EPROBE_DEFER; + goto out_put_larbs; } data->larb_imu[i].dev =3D &plarbdev->dev; =20 @@ -675,7 +680,7 @@ static int mtk_iommu_v1_probe(struct platform_device *p= dev) =20 ret =3D mtk_iommu_v1_hw_init(data); if (ret) - return ret; + goto out_put_larbs; =20 ret =3D iommu_device_sysfs_add(&data->iommu, &pdev->dev, NULL, dev_name(&pdev->dev)); @@ -697,12 +702,17 @@ static int mtk_iommu_v1_probe(struct platform_device = *pdev) iommu_device_sysfs_remove(&data->iommu); out_clk_unprepare: clk_disable_unprepare(data->bclk); +out_put_larbs: + for (i =3D 0; i < MTK_LARB_NR_MAX; i++) + put_device(data->larb_imu[i].dev); + return ret; } =20 static void mtk_iommu_v1_remove(struct platform_device *pdev) { struct mtk_iommu_v1_data *data =3D platform_get_drvdata(pdev); + int i; =20 iommu_device_sysfs_remove(&data->iommu); iommu_device_unregister(&data->iommu); @@ -710,6 +720,9 @@ static void mtk_iommu_v1_remove(struct platform_device = *pdev) clk_disable_unprepare(data->bclk); devm_free_irq(&pdev->dev, data->irq, data); component_master_del(&pdev->dev, &mtk_iommu_v1_com_ops); + + for (i =3D 0; i < MTK_LARB_NR_MAX; i++) + put_device(data->larb_imu[i].dev); } =20 static int __maybe_unused mtk_iommu_v1_suspend(struct device *dev) --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E26322C21D5; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; cv=none; b=SRz6Ow02ppOyMsu/iYhR5UcRlR5ocN/qEK9VX2+Bv1FD1RbTZ71ERzPzIC0+vbREx7X5LVUm4/Drce95+I9cIzLLCpqQhUapQ8oJLCesZ8d0maJG8VM3CJ9tkGBvYhE7A4MMANp7XifElwn4zwfdUxae27uo3PkqvURSRTU0Kxw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; c=relaxed/simple; bh=wDP21Y+s5kDNajy5hJ04hNgl2yzcFWdlbeRzYPBXo4w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uFdpNd1zt4ptui7drkFs7uE4H+C9QrTbJewkeyUVNlYj6/vLPhzHJkW7N0eG4HvWMNl2F+WqcDj+XwVwKG+fZBZrbFun4MjHrZjM6JzvZb882v+U1lgoSZ3voZqR8Zus5DXComE14u3cmIuK8sgOkyyk7p40VYdT8/vV8xurGAc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QJHiHu0Y; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QJHiHu0Y" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A55F4C4CEFE; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=wDP21Y+s5kDNajy5hJ04hNgl2yzcFWdlbeRzYPBXo4w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QJHiHu0Y3vCKSkSUIXi3hTyUHQi8oaGwMOqMKxwrH26/cRPp9O+qGhJWAWjz07vNk fJEmm0IjSsLJRO/ZECu7IMR5A50pGjUqDPN617qBT8OIwQ++BDaneQ4KCSXgI0+XMF 4+eF/TGfELVoHYQQu4XL2Swo0K1KgkEP2vgdyo08eyack13K3fkQ3pKMSYfvfAu1fO D9BBAzi+l/J2ZVO+sNxyO7R8JfOw5L3RIILtLS8XfZftpYO/O5RcZkT9f0kPjJGfCx 8W+H0kb+I19fO3VvKbrvAGenpz+cviwLu/S1q9GSE8ut/TU4bBq3PUh21F0e5FG1Gu ZoKwfujw67BtQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083P-2sUG; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 10/14] iommu/mediatek-v1: add missing larb count sanity check Date: Mon, 20 Oct 2025 06:53:14 +0200 Message-ID: <20251020045318.30690-11-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add the missing larb count sanity check to avoid writing beyond a fixed sized array in case of a malformed devicetree. Acked-by: Robin Murphy Reviewed-by: Yong Wu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno --- drivers/iommu/mtk_iommu_v1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c index 44b965a2db92..55d6615a41a9 100644 --- a/drivers/iommu/mtk_iommu_v1.c +++ b/drivers/iommu/mtk_iommu_v1.c @@ -643,6 +643,9 @@ static int mtk_iommu_v1_probe(struct platform_device *p= dev) if (larb_nr < 0) return larb_nr; =20 + if (larb_nr > MTK_LARB_NR_MAX) + return -EINVAL; + for (i =3D 0; i < larb_nr; i++) { struct device_node *larbnode; struct platform_device *plarbdev; --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 295512C326C; Mon, 20 Oct 2025 04:56:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; cv=none; b=QRLMSqwA2bCYqpFtGv7LjZJPWnH61xBNw5sVcCQouKGvqcGsl6mOvf+ZxPJq95T1BXq3VkmzOyJYX54E1mMX+FAUJZ4VSXdHd8MnZkZl5uVtPN7UoQdUoaIsxSo+yCZjbTP1QS+6Hzd1N8SEgfuOetnWbKSXpOpYI6z8E+974bw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; c=relaxed/simple; bh=MYEOUbyF4ZGD5XYEwadELPgQLrWxXxJkfb5idHjpHFo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gy4ogA0USotvwu5+UhlnxroX3RSfJIrOv11q6z+0vHjJCofY2DmAM7PBnjZ3Of6fYOrTcqqW1F594W5DhxXW5nmxNAeNuFHj95FgOA/Y8WZFhEyH0CBf0PsBfPDitVOMvDXc5IiPVcmmyo3WSPgS7SvKd9IFwV10ntZFocBPfaI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=j+YgynLQ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="j+YgynLQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1FBAC4AF15; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936198; bh=MYEOUbyF4ZGD5XYEwadELPgQLrWxXxJkfb5idHjpHFo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j+YgynLQSCK3/n+whncI0z58x+0lE8g3mkuDkUeI8TeNfp6yvZNRgtc+a9yrrK7Yy Bz0CEZ4EsgTC6g0p7tJ3J8urs/E+8TfTkhGLvv0VU37H9BFLK0sAP3NsVIYXwNvBI5 qe9+bsH+fOjdjj6YkCIygOg+h1VY5hCUMp6cedqJLwg1Qh1TtuVgw2Zsyt3p0mkee5 31W417IVWmrYdS/HgHyB7xu/mv76LzMcElFppmXoXwRZ6YdxKfO4Rv4FkfIK2ZiA+M RIR3USN4lRsHlJiee7fklKTz9G3bqtJg1wV2LDT8Qi4KmMR/kiL8n8muqTynmSoAMt nAL0LAiHKiZiA== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083T-3ILe; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Suman Anna Subject: [PATCH v3 11/14] iommu/omap: fix device leaks on probe_device() Date: Mon, 20 Oct 2025 06:53:15 +0200 Message-ID: <20251020045318.30690-12-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the references taken to the iommu platform devices when looking up their driver data during probe_device(). Note that the arch data device pointer added by commit 604629bcb505 ("iommu/omap: add support for late attachment of iommu devices") has never been used. Remove it to underline that the references are not needed. Fixes: 9d5018deec86 ("iommu/omap: Add support to program multiple iommus") Fixes: 7d6827748d54 ("iommu/omap: Fix iommu archdata name for DT-based devi= ces") Cc: stable@vger.kernel.org # 3.18 Cc: Suman Anna Acked-by: Robin Murphy Signed-off-by: Johan Hovold --- drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c index 5c6f5943f44b..c0315c86cd18 100644 --- a/drivers/iommu/omap-iommu.c +++ b/drivers/iommu/omap-iommu.c @@ -1675,6 +1675,7 @@ static struct iommu_device *omap_iommu_probe_device(s= truct device *dev) } =20 oiommu =3D platform_get_drvdata(pdev); + put_device(&pdev->dev); if (!oiommu) { of_node_put(np); kfree(arch_data); @@ -1682,7 +1683,6 @@ static struct iommu_device *omap_iommu_probe_device(s= truct device *dev) } =20 tmp->iommu_dev =3D oiommu; - tmp->dev =3D &pdev->dev; =20 of_node_put(np); } diff --git a/drivers/iommu/omap-iommu.h b/drivers/iommu/omap-iommu.h index 27697109ec79..50b39be61abc 100644 --- a/drivers/iommu/omap-iommu.h +++ b/drivers/iommu/omap-iommu.h @@ -88,7 +88,6 @@ struct omap_iommu { /** * struct omap_iommu_arch_data - omap iommu private data * @iommu_dev: handle of the OMAP iommu device - * @dev: handle of the iommu device * * This is an omap iommu private data object, which binds an iommu user * to its iommu device. This object should be placed at the iommu user's @@ -97,7 +96,6 @@ struct omap_iommu { */ struct omap_iommu_arch_data { struct omap_iommu *iommu_dev; - struct device *dev; }; =20 struct cr_regs { --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A57D2C2345; Mon, 20 Oct 2025 04:56:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; cv=none; b=jYNeVL+aq0pOjhvHrJSVB7LvWp6JSKZlFA5n4gbA0eqwCnKOOdLkHOw9eF8WcuJD7yXhiSRnwYiDv+10V2qtWERCeBAl8/OWTMDE41SD1BgqoAyirfBFIzDGMXeNTbB6TwV5v2Chp9XnwpjZcDxsyin/U7YIQGOFAm2gPb+nG2s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; c=relaxed/simple; bh=czt+mLY75+c/6bsLisPC4wh/lUvSc1D12TbPg946eV4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SIig6b6lIJ3A2IfhUp5GJalwl6z0lpQp7DUj202LSZQaxk1nAliprlkuwDes64lwqc7Ea7J5exMsk2M3A4n51+dGWbA0kRI8g+Xso3IOtM0f8TiQewKMhtMpDhD4fjds1wExwUTMlps0ydiw0xuyD3FA01b5kEqCeOqWXGi5feE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=pdFaARmk; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="pdFaARmk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1684C4AF14; Mon, 20 Oct 2025 04:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936197; bh=czt+mLY75+c/6bsLisPC4wh/lUvSc1D12TbPg946eV4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pdFaARmk3vMAKMbcoZ2VIOKstcro1rl5TkL9Lc9L3Exn+5nClyEyQ/tEP7njLZMbk gtdJHSkM7+T9s2IN0PzDPzhCIfYacnQZNhcGBSeu7VQ5AvTc7FE0Q43s3+KgdoLma6 ePD+gGs1qofP3qlFpfPZmITFhK1wC+1lwqiHnu+rpVZ03NJbTSez7gqUyQg+bpqkcM jTYtzhEivllffstAMXAkVuhyu5BAGFhBNICTZ5Oqb9HWBSNe2aEhfh9R1sfJr71GzK ChqoBL80XvfY6nrbYsMOsr4o5Ggm0/Oer6Rz5/K46+BT8zK+CGcXSmAGZGkZBuQXlz aRBmbGyF6uabw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083V-3iVU; Mon, 20 Oct 2025 06:56:41 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 12/14] iommu/omap: simplify probe_device() error handling Date: Mon, 20 Oct 2025 06:53:16 +0200 Message-ID: <20251020045318.30690-13-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Simplify the probe_device() error handling by dropping the iommu OF node reference sooner. Acked-by: Robin Murphy Signed-off-by: Johan Hovold --- drivers/iommu/omap-iommu.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c index c0315c86cd18..7bbc6928c8d0 100644 --- a/drivers/iommu/omap-iommu.c +++ b/drivers/iommu/omap-iommu.c @@ -1668,8 +1668,8 @@ static struct iommu_device *omap_iommu_probe_device(s= truct device *dev) } =20 pdev =3D of_find_device_by_node(np); + of_node_put(np); if (!pdev) { - of_node_put(np); kfree(arch_data); return ERR_PTR(-ENODEV); } @@ -1677,14 +1677,11 @@ static struct iommu_device *omap_iommu_probe_device= (struct device *dev) oiommu =3D platform_get_drvdata(pdev); put_device(&pdev->dev); if (!oiommu) { - of_node_put(np); kfree(arch_data); return ERR_PTR(-EINVAL); } =20 tmp->iommu_dev =3D oiommu; - - of_node_put(np); } =20 dev_iommu_priv_set(dev, arch_data); --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B6A92C3271; Mon, 20 Oct 2025 04:56:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; cv=none; b=dh6Ig1f0MJyii80TvzcMjQAGWwtror52GJxOqZuAkyoCI6QoldDACMXubiZBGU2YQdWGokpgo3/iM0CUPZspMbo5ppRqVi6mVNa0IMGVVirUbuQuwxLY02XI2UHjM5LPTFG6RRIPuBMuyyYKvkWf+JOuVb+HLZFwFP3klD3Sg4Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; c=relaxed/simple; bh=XGze0MX6pPcBSBg10ExvQZidlcuv2+y5+RAOY6fdhVM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hs2n47kFf/rq9SNbXpFCHQYa/nYcDXpSXz6Sf3aq2SVquJV8QAoTjFLDZ6OYiNGZqnlpY70oBD0RVR8K8CxZIvK/NCllFfM0PHaN2qiB7Np7Z1e1/cS3ZiOTvIzWktzp9MYtjvINUCiZj8LpHRK6v0kbWkzKsCRDzRpxeeWzEQM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bx+k0I0X; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bx+k0I0X" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0292BC4CEFB; Mon, 20 Oct 2025 04:56:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936198; bh=XGze0MX6pPcBSBg10ExvQZidlcuv2+y5+RAOY6fdhVM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bx+k0I0XUtKJO27R4DdFmQPbslCm5/pwQwgx8hY4tv5t5vccMmIQhW7VS2Vwzn1d2 60JRs6xZi+OTehxr8ORlKczqVvIg+LeHHIWn50ZZH1U1vOJ89NApUHO6y29sURPNa3 Yk+n9q3mqOpe52h37kAhvFiKOUszsUG2vmDGJY3DYxs6N9VM+V3Q0MpZVgKgDbcrvQ j2K1Qh9U1jvgLk4usT0xblZSIEkKRjlUNy6l01dgTlQmcbBjyMS/sOTRpnStW/SagY 2/Emvy5veqzS5SX2yDqKVOKhypgh+xLCAgbqvIxAzWtGNlXGqcfyc0fAjou3lKgxQ1 pYD8zWkEaiR0g== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwn-0000000083Y-48lT; Mon, 20 Oct 2025 06:56:42 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Maxime Ripard Subject: [PATCH v3 13/14] iommu/sun50i: fix device leak on of_xlate() Date: Mon, 20 Oct 2025 06:53:17 +0200 Message-ID: <20251020045318.30690-14-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 4100b8c229b3 ("iommu: Add Allwinner H6 IOMMU driver") Cc: stable@vger.kernel.org # 5.8 Cc: Maxime Ripard Acked-by: Robin Murphy Signed-off-by: Johan Hovold --- drivers/iommu/sun50i-iommu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/sun50i-iommu.c b/drivers/iommu/sun50i-iommu.c index de10b569d9a9..6306570d57db 100644 --- a/drivers/iommu/sun50i-iommu.c +++ b/drivers/iommu/sun50i-iommu.c @@ -839,6 +839,8 @@ static int sun50i_iommu_of_xlate(struct device *dev, =20 dev_iommu_priv_set(dev, platform_get_drvdata(iommu_pdev)); =20 + put_device(&iommu_pdev->dev); + return iommu_fwspec_add_ids(dev, &id, 1); } =20 --=20 2.49.1 From nobody Wed Dec 17 12:14:36 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47D252D027F; Mon, 20 Oct 2025 04:56:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; cv=none; b=eo/y5Nzbuh/kLPWTjcP63kADXIhi4YGkE0W4AZX4UL4aDH9Z7tjEmQO4iL8kJ5ErXTAMJhk6V6jClyn1/Qb5N4Czdd714MuaBGOpEmWTFUeAF7fJpHYd5E3uJFXaAFPFdUv2BgzHr+htUKj9RtgrWw9RR6PPBpuiEYuLFw1irFg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760936198; c=relaxed/simple; bh=I1WdqYJWLR3PNSOWKpin7GH4bbZsu9qz49UM1zdBbDo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OYD2ciEpDJLHz8QfNYew0qTTbmCPnVhIhs4jU+0lY1PQIRYV9zHMczaqokbe46yoBUMoWrhZJRgkjltMcYyQG8FHt1MD5oIJ7lIs4gZY/RwvRsV9DLa+QrEwz+w6pM1tKKQmRezuNpsnLepFg0MBWa6xP2x0zi/XQsEQ0AB4PYM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NE+3MNAL; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NE+3MNAL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19C44C4CEFE; Mon, 20 Oct 2025 04:56:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760936198; bh=I1WdqYJWLR3PNSOWKpin7GH4bbZsu9qz49UM1zdBbDo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NE+3MNAL8pCWwQSpY+zdGeHjh9pQQO7YW3PLk/0h1w4tkRIQnZwbujBnxt9upN9Kz QaoSzBCd5rZMXQWMYvepUk8XAJQ/Ov/9YlSFR+sWJHJX8VVE1ePHbV2jP8AffTmw13 uFaFwzxy3YO2vLeSM+B8I6gskE/XTbFWylcacZ+osCM4hwmZ7KTXxxsZYUTi8jTJTa QAJ4q6jCkBpY6cxzmJNOY6N0B4NzM3I1REv4nDifgOY0AIpTcBz0Sr5u4zZCEH9gcb q4wWObZDOOnnVSrW5U+CkmWCOgfi/DCHyS+B7YbFgwCj7gb0WxGNBMZeQ8vchE7i/G FYX8FlWmFgOlQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1vAhwo-0000000083i-0NeK; Mon, 20 Oct 2025 06:56:42 +0200 From: Johan Hovold To: Joerg Roedel , Will Deacon Cc: Robin Murphy , Sven Peter , Janne Grunau , Rob Clark , Marek Szyprowski , Yong Wu , Matthias Brugger , AngeloGioacchino Del Regno , Chen-Yu Tsai , Thierry Reding , Krishna Reddy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Miaoqian Lin , Thierry Reding Subject: [PATCH v3 14/14] iommu/tegra: fix device leak on probe_device() Date: Mon, 20 Oct 2025 06:53:18 +0200 Message-ID: <20251020045318.30690-15-johan@kernel.org> X-Mailer: git-send-email 2.49.1 In-Reply-To: <20251020045318.30690-1-johan@kernel.org> References: <20251020045318.30690-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device(). Note that commit 9826e393e4a8 ("iommu/tegra-smmu: Fix missing put_device() call in tegra_smmu_find") fixed the leak in an error path, but the reference is still leaking on success. Fixes: 891846516317 ("memory: Add NVIDIA Tegra memory controller support") Cc: stable@vger.kernel.org # 3.19: 9826e393e4a8 Cc: Miaoqian Lin Acked-by: Robin Murphy Acked-by: Thierry Reding Signed-off-by: Johan Hovold --- drivers/iommu/tegra-smmu.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c index 36cdd5fbab07..f6f26a072820 100644 --- a/drivers/iommu/tegra-smmu.c +++ b/drivers/iommu/tegra-smmu.c @@ -830,10 +830,9 @@ static struct tegra_smmu *tegra_smmu_find(struct devic= e_node *np) return NULL; =20 mc =3D platform_get_drvdata(pdev); - if (!mc) { - put_device(&pdev->dev); + put_device(&pdev->dev); + if (!mc) return NULL; - } =20 return mc->smmu; } --=20 2.49.1