From: Xiong Weimin <xiongweimin@kylinos.cn>

On Thu, Jul 16, 2026 at 09:21:57AM +0800, Will Deacon wrote:
> It's really hard to keep track of all the patches you have on the list.
> Some of them are grouped in a series [1] with a dependency on another
> unmerged patch, others are in-reply to unordered patches [2], nothing is
> versioned and there are unlinked reply-to messages asking us to ignore
> things [3].
>
> Please can you group all related changes into a series, with a cover
> letter and then use versioning so that it's clear which is the latest
> revision?

I apologize for the confusion. I've now combined all related virtio-iommu
fixes into this single v2 series with a proper cover letter.

I've also addressed Sashiko's comments on the error handling in
viommu_probe() [4] - the v2 series sets vdev->priv early before creating
virtqueues and properly unwinds all resources on failure.

This series contains three fixes:

1. Set driver data before enabling virtqueues
   - Store vdev->priv before creating virtqueues so that the event virtqueue
     callback always sees initialized driver state when the device is made
     ready.

2. Handle iommu_device_register() failures
   - Properly propagate errors from iommu_device_register() and unwind sysfs
     entries, virtqueues, and driver data on failure.

3. Reject short event buffers
   - Check for exact buffer size match (len != sizeof(*evt)) instead of just
     rejecting oversized buffers (len > sizeof(*evt)).

Changes in v2:
- Combined all three fixes into a single series with cover letter
- Reordered patches to reflect dependencies
- Added err_clear_priv label for early error paths

Xiong Weimin (3):
  iommu/virtio: Set driver data before enabling virtqueues
  iommu/virtio: Handle iommu_device_register() failures
  iommu/virtio: Reject short event buffers

 drivers/iommu/virtio-iommu.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

-- 
2.43.0


From: Xiong Weimin <xiongweimin@kylinos.cn>
To: Jean-Philippe Brucker <jpb@kernel.org>,
	Joerg Roedel <joro@8bytes.org>,
	Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
	virtualization@lists.linux.dev,
	iommu@lists.linux.dev,
	linux-kernel@vger.kernel.org
Subject: [PATCH v2 1/3] iommu/virtio: Set driver data before enabling virtqueues
Date: Thu, 23 Jul 2026 09:51:01 +0800
Message-ID: <20260723095101.1-xiongweimin@kylinos.cn>
References: <20260716012157.88769-2-xiongwm2026@163.com>
In-Reply-To: <20260716012157.88769-2-xiongwm2026@163.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Xiong Weimin <xiongweimin@kylinos.cn>

The event virtqueue callback retrieves the driver state through
vq->vdev->priv. viommu_probe() currently initializes that pointer only
after virtio_device_ready() and after the event queue is populated.

Store the driver data before creating the virtqueues so callbacks always
see initialized driver state once the device is made ready. Clear the
pointer again on probe failure.

Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
---
 drivers/iommu/virtio-iommu.c | 14 ++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 587fc1319..fb19d0bf4 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -1169,11 +1169,12 @@ static int viommu_probe(struct virtio_device *vdev)
 	ida_init(&viommu->domain_ids);
 	viommu->dev = dev;
 	viommu->vdev = vdev;
+	vdev->priv = viommu;
 	INIT_LIST_HEAD(&viommu->requests);
 
 	ret = viommu_init_vqs(viommu);
 	if (ret)
-		return ret;
+		goto err_clear_priv;
 
 	virtio_cread_le(vdev, struct virtio_iommu_config, page_size_mask,
 			&viommu->pgsize_bitmap);
@@ -1234,9 +1235,9 @@ static int viommu_probe(struct virtio_device *vdev)
 	if (ret)
 		goto err_free_vqs;
 
-	vdev->priv = viommu;
-
-	iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
+	ret = iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
+	if (ret)
+		goto err_free_sysfs;
 
 	dev_info(dev, "input address: %u bits\n",
 		 order_base_2(viommu->geometry.aperture_end));
@@ -1244,8 +1245,12 @@ static int viommu_probe(struct virtio_device *vdev)
 
 	return 0;
 
+err_free_sysfs:
+	iommu_device_sysfs_remove(&viommu->iommu);
 err_free_vqs:
 	vdev->config->del_vqs(vdev);
+err_clear_priv:
+	vdev->priv = NULL;
 
 	return ret;
 }
-- 
2.43.0


From: Xiong Weimin <xiongweimin@kylinos.cn>
To: Jean-Philippe Brucker <jpb@kernel.org>,
	Joerg Roedel <joro@8bytes.org>,
	Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
	virtualization@lists.linux.dev,
	iommu@lists.linux.dev,
	linux-kernel@vger.kernel.org
Subject: [PATCH v2 2/3] iommu/virtio: Handle iommu_device_register() failures
Date: Thu, 23 Jul 2026 09:51:02 +0800
Message-ID: <20260723095102.1-xiongweimin@kylinos.cn>
References: <20260716012157.88769-2-xiongwm2026@163.com>
In-Reply-To: <20260716012157.88769-2-xiongwm2026@163.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Xiong Weimin <xiongweimin@kylinos.cn>

iommu_device_register() returns an error when the IOMMU core fails to
register the hardware instance or probe the buses. viommu_probe()
currently ignores that error and continues as if the device was
registered successfully.

Propagate the failure and unwind the sysfs entry and virtqueues that
were set up earlier. Clear the driver data on the error path as well,
since it is set before registration so bus probing can find the
virtio-IOMMU instance.

Reviewed-by: Will Deacon <will@kernel.org>
Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
---
 drivers/iommu/virtio-iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 587fc1319..fb19d0bf4 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -1234,9 +1234,11 @@ static int viommu_probe(struct virtio_device *vdev)
 	if (ret)
 		goto err_free_vqs;
 
-	vdev->priv = viommu;
-
-	iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
+	ret = iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
+	if (ret)
+		goto err_free_sysfs;
 
 	dev_info(dev, "input address: %u bits\n",
 		 order_base_2(viommu->geometry.aperture_end));
@@ -1244,8 +1246,12 @@ static int viommu_probe(struct virtio_device *vdev)
 
 	return 0;
 
+err_free_sysfs:
+	iommu_device_sysfs_remove(&viommu->iommu);
 err_free_vqs:
 	vdev->config->del_vqs(vdev);
+err_clear_priv:
+	vdev->priv = NULL;
 
 	return ret;
 }
-- 
2.43.0


From: Xiong Weimin <xiongweimin@kylinos.cn>
To: Jean-Philippe Brucker <jpb@kernel.org>,
	Joerg Roedel <joro@8bytes.org>,
	Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
	virtualization@lists.linux.dev,
	iommu@lists.linux.dev,
	linux-kernel@vger.kernel.org
Subject: [PATCH v2 3/3] iommu/virtio: Reject short event buffers
Date: Thu, 23 Jul 2026 09:51:03 +0800
Message-ID: <20260723095103.1-xiongweimin@kylinos.cn>
References: <20260716012157.88769-2-xiongwm2026@163.com>
In-Reply-To: <20260716012157.88769-2-xiongwm2026@163.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Xiong Weimin <xiongweimin@kylinos.cn>

viommu_event_handler() only rejects event buffers that are larger than
struct viommu_event. A short buffer is also invalid, but the handler
would still read evt->head and, for fault events, the rest of evt->fault.

Require the used length to match the event buffer size before looking at
the event contents.

Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
---
 drivers/iommu/virtio-iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 587fc1319..fb19d0bf4 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -635,7 +635,7 @@ static void viommu_event_handler(struct virtqueue *vq)
 	struct viommu_dev *viommu = vq->vdev->priv;
 
 	while ((evt = virtqueue_get_buf(vq, &len)) != NULL) {
-		if (len > sizeof(*evt)) {
+		if (len != sizeof(*evt)) {
 			dev_err(viommu->dev,
 				"invalid event buffer (len %u != %zu)\n",
 				len, sizeof(*evt));
-- 
2.43.0