From nobody Sat Jul 25 05:35:00 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8ACCF3BC673 for ; Fri, 17 Jul 2026 09:26:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784280363; cv=none; b=X5qepvQfZG2CC5XhT7n0Te8p9rVJNTvfW+9DJv8U+yrQ/e9mrLFImy8fLgJL6reVp/Q1nR7FSn2hHp1K8lFpwo4xgrbgH6Y/qfZiFY5GKNPE7G1T9RW2KfPwIj0/6qWH7x6Bj0QIwn5WjF4Y7BNUXCf3gw8TgDDnfAkU7nzh/3A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784280363; c=relaxed/simple; bh=IJM12IPhydPMhVfgKAD3r1R+hMTUt/15MFROcI+Z0fY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=oQMEYZABrLoMWkcnXerbZsgJXh13kk1O7oRWuGKnHwpuHn4QCTntcIwFJBOZzlPVPIHS6chIKasJg7OvciYCPpKXhoW4nnvEawgZyX/2dNxB2wLjFeCt7qMYwt6mWkIsEJK315eznn9Q4TJDZLPuVpQapui7QosQc7nDKL2YS6o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=LO7M9aoz; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=HmRmlLNJ; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="LO7M9aoz"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="HmRmlLNJ" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66H9L2gH1461448 for ; Fri, 17 Jul 2026 09:26:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=P4U1vKKGfvsW3iPMjF5IU+ stSAtAMqxWdBp0JhDoid0=; b=LO7M9aozz5kwEywpc5rYJPjQiC5tJNeR460jFy uCgFQOdVUOXwsb/zsRsCTWlZmc6wL2hlRzIBtzZkeXaGk1b3qGhyEMHDhWdwfkO4 QnkMlg6gTsJfJvPUVqJQfbOT4VujVUTqI3FMCsEUOdIuXvmCG7LO90jIKqpazDqr k5OODjn0b5jjbbAXcASjumElpdpuY5eviCK06WsEB2Llpx4sIgZ6f+bCkd3EgeEs jBkVD9CU9as0MNjhGQb3pyYeUTb2yie7IjaF4ZunB+CPuGFumNUir2sXxxqBwlYJ QrIqNSyYy1aXPKy+11rIamQ+kO9elGj/aNDq3zw57fq95IQQ== Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ffhpfg0m6-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 17 Jul 2026 09:25:59 +0000 (GMT) Received: by mail-pf1-f198.google.com with SMTP id d2e1a72fcca58-8487eb67173so12178301b3a.2 for ; Fri, 17 Jul 2026 02:25:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784280359; x=1784885159; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=P4U1vKKGfvsW3iPMjF5IU+stSAtAMqxWdBp0JhDoid0=; b=HmRmlLNJmo2vb/TbD2J/sZXI6gtvNfpV3cgZh7elItDvSDwBlEiRotyp5BBVs5UTUv JYhVKPJeVgoMtwM9LRG2goLD2VfbGDHfMotFMhOaSpcRb/Za72QnHw3W4WLcksg5NtrP PJAUGBgS6/5lsZG2eCjJlbYhdpQatwTwvZyXhzBp8LZaXbUT9ka8Pb0xRzHnm+b78oEZ 7wASYcj51fuVqYZ60pS4ETrCR9ix11tWM1q9BN7uSZfzYw0jpjk7VuZAas0i1YLU/IaL us8HIZqVvgq+erWQCghAjTTDNZDxrkSe5MACTo+cggpC8iGbQL+mSyw59tknwxQN7m6s ScfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784280359; x=1784885159; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=P4U1vKKGfvsW3iPMjF5IU+stSAtAMqxWdBp0JhDoid0=; b=M2LkH8Uq0eYw+Hw9pIimBtUgC+U+TbZgnd5trU1TKHddnI2tepJcASdeo01ATWXAb/ xMIZRi4szmlb01L5oGWOh3LcALC/djOd5nse5bwKahk85Q18OkDHGVks1ro8JYwYTbJt fqPLEIhfgHeTV5Lw1gr6+ospBr4umCh4Ycn+e7/Hl/FzhYQcMbOS2xopZQJ0H8F1aMzP AY6r1KY1hSSmYmGrwgZFP/t+PAMKHiZd235+lHLpDjkwRfWxblgQHOJTP7SmItTPDyuX xrZfJm/B7qjPDDPsJgRmTJ1fOcEdY0eQD2yq+Bp1jwRLlnsm5095c+QRIS2yMS+L2uLg tXHg== X-Forwarded-Encrypted: i=1; AHgh+Rq4YJ7T5zO/5lgq4ZrelNV1MORH0vIekDoTOLQqFgT/Pa96bXK5K5tweDxS5Hn6YbQXazWUZ9JVN2J0/yE=@vger.kernel.org X-Gm-Message-State: AOJu0YwH+sFlNZNAW3k7vVSFB7GMMZyVWCpIMWfO0gNAvW5A9SPgVq0M 0JPAmfZEuW8mpTolIiV44elmFTqKvNJbcBe3Dx9gRzWUlffJYNNtgi72ZXjefJUNNR0/487h8Ga my//7bX8MVe1p+8Kdo5zgVsM6c88c8MBF3cvD3Uo+UAIdHXdhAG9bnNvTnn44uhMjqnnqbP5QWH I= X-Gm-Gg: AfdE7cniC+ORQpQsfTSn4paVhmKfLv3ZtQrvETSYkAkgxNHonsJabfPBOP+gK69lYXa dhWR39oDbZVZDNh6Q/Wnd58uafZRqS+LhaqKw351OsKdx+p3n2L1MCR8XbI2mW7m7Zoi2Y2kQBT gXzsl5vL6/xtMBcCNefQ6z3hD7unbWxC3j1j5LfmlT4XUZXifO5Jctw0Lo5J7hbI2rCUu+KzloK a3sh4gQiEpoZDbgK7sb9l9EM0epGNkdUCiyP7DZK6COQW+AyPbptNzKCu3mKwg182xojwSSWnUv MX0w0AnmSwYcM/rwlyJTzCW8ELEa58STGOmkw8b26KQXTaDsaiczo6qSKUgvCjT+TtZoya8BaFc Uc1zxIa2rTQk4Goq4vMg7IjpQksmjWagkpw== X-Received: by 2002:a05:6a00:4149:b0:848:7b92:8e79 with SMTP id d2e1a72fcca58-84c295278aemr1810007b3a.67.1784280358881; Fri, 17 Jul 2026 02:25:58 -0700 (PDT) X-Received: by 2002:a05:6a00:4149:b0:848:7b92:8e79 with SMTP id d2e1a72fcca58-84c295278aemr1809974b3a.67.1784280358358; Fri, 17 Jul 2026 02:25:58 -0700 (PDT) Received: from hu-ketakish-hyd.qualcomm.com ([202.46.22.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2af6d8b3sm658379b3a.42.2026.07.17.02.25.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 02:25:57 -0700 (PDT) From: Ketan Kishore Date: Fri, 17 Jul 2026 14:55:47 +0530 Subject: [PATCH v2] amba: bus: Fix race condition during DMA configure at IOMMU probe time Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-iommu_races-v2-1-d0b7789275af@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIABr1WWoC/1WNQQ6CMBBFr0JmbQltEcGV9zDElDLIGKHaAaIh3 N2CceFmkpe8/2YGRk/IcIxm8DgRk+sDqF0EtjX9FQXVgUElKksOMhXkum68eGORhUl1pm1hmiJ XEBYPjw29ttq5/DKP1Q3tsCZWoyUenH9v7ya5er/y/q88SSGFtinWUlcyN/rkmOPnaO42WHE4U C7L8gHjByWMvwAAAA== X-Change-ID: 20260714-iommu_races-a4363c9af982 To: Russell King , "Rob Herring (Arm)" , Jason Gunthorpe , Bjorn Helgaas , Lorenzo Pieralisi , Joerg Roedel Cc: kernel@oss.qualcomm.com, Robin Murphy , Will McVicker , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Ketan Kishore X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1784280354; l=3320; i=ketan.kishore@oss.qualcomm.com; s=20260617; h=from:subject:message-id; bh=IJM12IPhydPMhVfgKAD3r1R+hMTUt/15MFROcI+Z0fY=; b=xTlHyOPTjU0bQ86chbLU7U4TzuZPy5yJiGOohpT6CbHHHs9Y4chReL5lofaga4TQ3/VUmzTi4 /8v5rCYVZqaBH9k0FsJOSVfb8EVin7o/kLjYwsfXEhig3jh+D8AYrqx X-Developer-Key: i=ketan.kishore@oss.qualcomm.com; a=ed25519; pk=4sb5Ima5x03wc0KSnl57v8kR/7FxMt01+xlZJ53rSJU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE3MDA5MiBTYWx0ZWRfXxXgAXPD8fdUn 4HeVoUexRs/k4vkH6+bEcnD8QHBD6Zi842yHIchUM6DjY9BTv3j+U20mYGWZg9DjwKQTgaiyOfM aMQVW04gXPNciyRr7uS0KKK3nPlOGzfFz4pTd7c0vB7fRbyqCt4mhm0fkBPnTL6GzjZxs3f9gfa yerOGuN5G6cavstxbXDyhL2YJOVoGCGvQ6gsLYcEGD8Uwqf5Jrn4nC0Wwa1tY+5DR1uvN81/GTr DRRulFbEJWL69yvr9XcuIFDm2ezi979mCYTOeM1sCHj9ZL/IGKJSBEaXK9I5Pq1YrBj0m/mOY2L FTuhnUv1+p+lrFmx1doe17jzaahnHCSlnEqiK8Wos9BtYUG7EMbjGm9Qt8OdbkFA19bJR8vg0MZ V7GlylCKRR9V7s5nX0OUlMsWIV/iNytzN3oFDicWlRuvyA0GQfISSPrElh3kGGjSEZvCkx8ucZf LPkK3S+gfdYpOvERgtQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE3MDA5MiBTYWx0ZWRfX35uXNprP61h9 gzOoaAWm7ovQZhKSbJAIUkuJaAA1Aq6QU/5aicS8awMUxfyB2cknYPAMpHbRuY4v7gFXDXiBLhB xCOgshVTW+goE1IL4oX3d25m+ZpkOo8= X-Authority-Analysis: v=2.4 cv=YeWNIQRf c=1 sm=1 tr=0 ts=6a59f527 cx=c_pps a=m5Vt/hrsBiPMCU0y4gIsQw==:117 a=fChuTYTh2wq5r3m49p7fHw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=PHq6YzTAAAAA:8 a=7CQSdrXTAAAA:8 a=1XWaLZrsAAAA:8 a=9jRdOu3wAAAA:8 a=DEt-5Vgr3fpEtGrxzCkA:9 a=QEXdDO2ut3YA:10 a=IoOABgeZipijB_acs4fv:22 a=FO4_E8m0qiDe52t0p3_H:22 a=ZKzU8r6zoKMcqsNulkmm:22 a=a-qgeE7W1pNrGK8U0ZQC:22 a=ZE6KLimJVUuLrTuGpvhn:22 X-Proofpoint-GUID: -_p0zmeYJ78rvjFyjOCvkVlbHf9Ujf4A X-Proofpoint-ORIG-GUID: -_p0zmeYJ78rvjFyjOCvkVlbHf9Ujf4A X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-17_02,2026-07-15_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 bulkscore=0 suspectscore=0 priorityscore=1501 clxscore=1015 spamscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607170092 amba_dma_configure() can be invoked from the IOMMU probe path while a device's driver is still being bound asynchronously by really_probe() on another thread. Call trace: amba_dma_configure __iommu_probe_device probe_iommu_group bus_for_each_dev iommu_device_register arm_smmu_device_probe platform_probe really_probe __driver_probe_device driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_scheduled_works worker_thread kthread ret_from_fork dev->driver is read and converted to a struct amba_driver before it is known whether dev->driver is actually set. If a driver bind completes concurrently with the IOMMU probe path, the driver_managed_dma could end up being dereferenced through an invalid pointer derived from NULL. Update amba_dma_configure() to read dev->driver once and test if it's NULL before using it. This ensures that we don't dereference an invalid amba driver pointer if the device driver is asynchronously bound while configuring the DMA. This is the same TOCTOU race already fixed for the platform bus in commit 95deee37a123 ("platform: Fix race condition during DMA configure at IOMMU probe time") and for fsl-mc in commit 152f33ee30ee ("bus: fsl_mc: Fix driver_managed_dma check"). amba_dma_configure() has the identical pattern, so apply the same fix here. Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path= ") Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Ketan Kishore --- Changes in v2: - Change the patch's commit description to only CC stable for 6.1+ stable k= ernel branches and not for all stable releases prior to 6.1 . - Link to v1: https://patch.msgid.link/20260715-iommu_races-v1-1-3c4ed13b18= a3@oss.qualcomm.com To: Russell King To: Robin Murphy To: Bjorn Helgaas To: Lorenzo Pieralisi To: Joerg Roedel To: "Rob Herring (Arm)" Cc: kernel@oss.qualcomm.com Cc: Jason Gunthorpe Cc: linux-kernel@vger.kernel.org --- drivers/amba/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c index d721d64a9858..0cdda7e07af7 100644 --- a/drivers/amba/bus.c +++ b/drivers/amba/bus.c @@ -324,7 +324,7 @@ static void amba_shutdown(struct device *dev) =20 static int amba_dma_configure(struct device *dev) { - struct amba_driver *drv =3D to_amba_driver(dev->driver); + const struct device_driver *drv =3D READ_ONCE(dev->driver); enum dev_dma_attr attr; int ret =3D 0; =20 @@ -336,7 +336,7 @@ static int amba_dma_configure(struct device *dev) } =20 /* @drv may not be valid when we're called from the IOMMU layer */ - if (!ret && dev->driver && !drv->driver_managed_dma) { + if (!ret && drv && !to_amba_driver(drv)->driver_managed_dma) { ret =3D iommu_device_use_default_domain(dev); if (ret) arch_teardown_dma_ops(dev); --- base-commit: 49362394dad7df66c274c867a271394c10ca2bb8 change-id: 20260714-iommu_races-a4363c9af982 Best regards, -- =20 Ketan Kishore