From nobody Sat Jul 25 20:06:06 2026 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 87D7139FCDC for ; Tue, 14 Jul 2026 02:50:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.3 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997439; cv=none; b=H0MkSFNusjuFM+vljNVu6VvZ6sd+0KrhKakLNg4FWaVpyVJjwUq3UMyj9S30e4/H1EOQV+W+JerDyE/lWU1KH/l1NoS/xvcdVz65UutZs6ORONLm1QU3xftV27WdtPqAIyi8mu/No4PzcUW7rS7xxswpkll0xRMHe/QV/d2Vf/g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997439; c=relaxed/simple; bh=ya/eCWkRFhoEVs1Rvnde76R0Tdx+naOW1iFvHff1a2M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LqCrHDHgdZiFAJv5jd5xzcbrO1rOpghsihh9ZtU57wLpoPfUZzph4BKr2QApY4hbbzgduvertyMY6TB9cLiY21ufNNGSnYYgKt8HoPr1ZxDrEYmtFTvEV5R+vQO37sKaWKpBLfYClH/xKPolQXb9W1eScyfCIKbYY6IL8MhydZ8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=hVlp7HNF; arc=none smtp.client-ip=117.135.210.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="hVlp7HNF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=qc nLT+eEmwVk5tjFJsgW+fJ2wvhyEu0DistlKj3OBsQ=; b=hVlp7HNFjF+dGXn88k IehBxKCo5lt83mJXnvUMBBOA0oiB1FP1p7W65ZLP32/CJErUdVn/Vm+XmH8aHouX SLh8pZ75mEa5MNjApCMxZgfakleJGExJUTVkT/OmOA8DGXyUugjwKZCEw9RBZcnn HPUofy9pL3QEBmkcKXHwo1SeA= Received: from xwm-TianYi510Pro-14IMB.. (unknown []) by gzga-smtp-mtada-g1-1 (Coremail) with SMTP id _____wCXNQLNo1VqB9jsJA--.61058S3; Tue, 14 Jul 2026 10:49:59 +0800 (CST) From: weimin xiong <15927021679@163.com> To: Jean-Philippe Brucker , Joerg Roedel , Will Deacon Cc: Robin Murphy , virtualization@lists.linux.dev, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Xiong Weimin Subject: [PATCH v1 1/2] iommu/virtio: Avoid use-after-put in viommu_get_by_fwnode Date: Tue, 14 Jul 2026 10:49:48 +0800 Message-ID: <20260714024949.190014-2-15927021679@163.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260714024949.190014-1-15927021679@163.com> References: <20260714024949.190014-1-15927021679@163.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wCXNQLNo1VqB9jsJA--.61058S3 X-Coremail-Antispam: 1Uf129KBjvJXoW7ZrW5Xr4UGFWUZFyxGF17Wrg_yoW8Jw18pr y5Ga4DKrWUGF1xK3WxJw43uF1Yvan2yayfAFWFq39Ygrn5K34UtFyYyFyjqw1fArWkGr1a qw18Xa4vkrs8ZrJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07j5HUDUUUUU= X-CM-SenderInfo: jprvmjixqsilmxzbiqqrwthudrp/xtbC8xcOlmpVo9ffiAAA3g Content-Type: text/plain; charset="utf-8" From: Xiong Weimin bus_find_device() returns a device reference that must be released with put_device(). viommu_get_by_fwnode() currently drops that reference before dereferencing the device to fetch the virtio-IOMMU private data. Fetch the private data while the reference is still held, then release the device reference before returning. Signed-off-by: Xiong Weimin --- drivers/iommu/virtio-iommu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 587fc1319..342785c76 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -1009,12 +1009,16 @@ static int viommu_match_node(struct device *dev, co= nst void *data) =20 static struct viommu_dev *viommu_get_by_fwnode(struct fwnode_handle *fwnod= e) { + struct viommu_dev *viommu =3D NULL; struct device *dev =3D bus_find_device(virtio_bus_type, NULL, fwnode, viommu_match_node); =20 - put_device(dev); + if (dev) { + viommu =3D dev_to_virtio(dev)->priv; + put_device(dev); + } =20 - return dev ? dev_to_virtio(dev)->priv : NULL; + return viommu; } =20 static struct iommu_device *viommu_probe_device(struct device *dev) --=20 2.43.0 From nobody Sat Jul 25 20:06:06 2026 Received: from m16.mail.163.com (m16.mail.163.com [220.197.31.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72B38369204 for ; Tue, 14 Jul 2026 02:50:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.2 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997432; cv=none; b=Of5Fbg7r0TwIveCF2yTGteGW4e3fgZwdD4V5o/SEVqvoF0aD7n+3Yb0CETgMdDRKPoAxlCpXEuz0ze1eENxIeyYInB/j0zr5CLAoO/MCAtpwE4o03uvT4JzXOomNPQ5k9rK71XvyIHor3QTKvG8vXmFUYen8bTiTkHcIJMsVhco= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783997432; c=relaxed/simple; bh=PPbWPqbERNmgVmFvetStuEHyCIJfJiDYRMOJ6tHsL34=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UR4Zggqxd2fEU+afC61BBUR+nulKb18Mm4f8vNjJGkAwrmmvSn6gxGajWdDJomsDKSiAovsZowLJiqoTNtXkWfCbmQLfmM6wSgsnJ+adeif7Eoxp0kvSdPW1AIg1+xWfWzzn1gbNx71OP1o0t+aQLRUei6EqvnmC944syE/6MUM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=HFqpd/Fh; arc=none smtp.client-ip=220.197.31.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="HFqpd/Fh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=C2 /isRvdigohVTJa3M3a4dCirxli6CzG+eHKu4bm9Tw=; b=HFqpd/FhEfW7H6oDbh 00UpLddjVJi7p/rcjT/L9waj91MWaf9SdKKcGG0UgYboJKvEgfl6b06/+SM9cLUR zq4Hg3UwJvDj6/kyI+gUZhZTatJDSIm8iGubnzPqwN7CJYL8Ro6RARiUQGh2iPSe XMP1POZF+gqthdDThm2kWpyOE= Received: from xwm-TianYi510Pro-14IMB.. (unknown []) by gzga-smtp-mtada-g1-1 (Coremail) with SMTP id _____wCXNQLNo1VqB9jsJA--.61058S4; Tue, 14 Jul 2026 10:49:59 +0800 (CST) From: weimin xiong <15927021679@163.com> To: Jean-Philippe Brucker , Joerg Roedel , Will Deacon Cc: Robin Murphy , virtualization@lists.linux.dev, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Xiong Weimin Subject: [PATCH v1 2/2] iommu/virtio: Handle iommu_device_register() failures Date: Tue, 14 Jul 2026 10:49:49 +0800 Message-ID: <20260714024949.190014-3-15927021679@163.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260714024949.190014-1-15927021679@163.com> References: <20260714024949.190014-1-15927021679@163.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wCXNQLNo1VqB9jsJA--.61058S4 X-Coremail-Antispam: 1Uf129KBjvJXoW7Zry8tw43GFy5Gr4xtr17GFg_yoW8XF4Upa 4DCa95GrWUtFyfGay7Aay5ZF9Yvan2qay8XFWrX3ykWr15Gryjyr1ayFyUtw1fArWkGF42 qw1vqa1xuFZ8uFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jYD73UUUUU= X-CM-SenderInfo: jprvmjixqsilmxzbiqqrwthudrp/xtbC0RcOlmpVo9dc9AAA39 Content-Type: text/plain; charset="utf-8" From: Xiong Weimin iommu_device_register() returns an error when the IOMMU core fails to register the hardware instance or probe the buses. viommu_probe() currently ignores that error and continues as if the device was registered successfully. Propagate the failure and unwind the sysfs entry and virtqueues that were set up earlier. Clear the driver data on the error path as well, since it is set before registration so bus probing can find the virtio-IOMMU instance. Signed-off-by: Xiong Weimin --- drivers/iommu/virtio-iommu.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c index 342785c76..9118377d7 100644 --- a/drivers/iommu/virtio-iommu.c +++ b/drivers/iommu/virtio-iommu.c @@ -1240,7 +1240,9 @@ static int viommu_probe(struct virtio_device *vdev) =20 vdev->priv =3D viommu; =20 - iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev); + ret =3D iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev); + if (ret) + goto err_remove_sysfs; =20 dev_info(dev, "input address: %u bits\n", order_base_2(viommu->geometry.aperture_end)); @@ -1248,8 +1250,11 @@ static int viommu_probe(struct virtio_device *vdev) =20 return 0; =20 +err_remove_sysfs: + iommu_device_sysfs_remove(&viommu->iommu); err_free_vqs: vdev->config->del_vqs(vdev); + vdev->priv =3D NULL; =20 return ret; } --=20 2.43.0