iommu/arm-smmu-v3: Disable implementations during devm teardown

[PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

Posted by Wentao Guan 2 weeks, 1 day ago

The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
into the implementation device_disable() callback. However, its stable
backport preceded the conversion to devm teardown and could only invoke
the callback from the shutdown path.

Now that arm_smmu_disable_action() manages normal teardown, invoke the
implementation callback there while the command queue is still alive.
This prevents the subsequent implementation remove action from releasing
resources while the CMDQV hardware remains active.

After ("iommu/arm-smmu-v3: Manage teardown with devm") merged in stable,
now keep the shutdown path consistent with mainline, where disabling
the base SMMU is sufficient.

It is a fix for stable tree commit to aligned with mainline, so no
upstream commit id here.

Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index c993e101fab3a..ea908afb0da9d 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4789,6 +4789,8 @@ static void arm_smmu_disable_action(void *data)
 {
 	struct arm_smmu_device *smmu = data;
 
+	if (smmu->impl_ops && smmu->impl_ops->device_disable)
+		smmu->impl_ops->device_disable(smmu);
 	arm_smmu_device_disable(smmu);
 }
 
@@ -5621,8 +5623,6 @@ static void arm_smmu_device_shutdown(struct platform_device *pdev)
 {
 	struct arm_smmu_device *smmu = platform_get_drvdata(pdev);
 
-	if (smmu->impl_ops && smmu->impl_ops->device_disable)
-		smmu->impl_ops->device_disable(smmu);
 	arm_smmu_device_disable(smmu);
 }
 
-- 
2.30.2

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

Posted by Sasha Levin 1 week, 6 days ago

> Now that arm_smmu_disable_action() manages normal teardown, invoke the
> implementation callback there while the command queue is still alive.
> This prevents the subsequent implementation remove action from releasing
> resources while the CMDQV hardware remains active.
>
> Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
> Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

Queued for 7.2, thanks.

-- 
Thanks,
Sasha

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

Posted by Nicolin Chen 1 week, 6 days ago

On Thu, Sep 10, 2026 at 02:54:29PM +0800, Wentao Guan wrote:
> The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
> into the implementation device_disable() callback. However, its stable
> backport preceded the conversion to devm teardown and could only invoke
> the callback from the shutdown path.

Hmm, it did...

[correct in mainline]
git log --oneline v7.3-rc1 drivers/iommu/arm/arm-smmu-v3/
...
9ff145a25c5c8 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
2bd22a0d40503 iommu/arm-smmu-v3: Manage teardown with devm
...

[inverted in two trees]
git log --oneline v7.2.5 drivers/iommu/arm/arm-smmu-v3/
...
78fd5a2d65f35 iommu/arm-smmu-v3: Manage teardown with devm
f9b7375db3b36 iommu/arm-smmu-v3: Add HAFT support for SVA
5994617e09ee6 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
...

git log --oneline v6.18.51 drivers/iommu/arm/arm-smmu-v3/
...
2235eafda9b3d iommu/arm-smmu-v3: Manage teardown with devm
d903d99ffd22b iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
d2ab08437e913 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
...

[missing cmdqv fix]
git log --oneline v6.12.109 -33 drivers/iommu/arm/arm-smmu-v3/
...
981686f413776 iommu/arm-smmu-v3: Manage teardown with devm
...

Patch itself looks good to me for v7.2 stable and v6.8 longterm.

But v6.12 longterm might need some extra fix, Sasha?

> Now that arm_smmu_disable_action() manages normal teardown, invoke the
> implementation callback there while the command queue is still alive.
> This prevents the subsequent implementation remove action from releasing
> resources while the CMDQV hardware remains active.
> 
> After ("iommu/arm-smmu-v3: Manage teardown with devm") merged in stable,
> now keep the shutdown path consistent with mainline, where disabling
> the base SMMU is sufficient.
> 
> It is a fix for stable tree commit to aligned with mainline, so no
> upstream commit id here.
>
> Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
> Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

Acked-by: Nicolin Chen <nicolinc@nvidia.com>

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

Posted by Sasha Levin 1 week, 3 days ago

> Patch itself looks good to me for v7.2 stable and v6.8 longterm.

Queued for 6.18, thanks.

> But v6.12 longterm might need some extra fix, Sasha?

It does, but a different one. 6.12 has the devm teardown conversion and never
got 9ff145a25c5c ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on
teardown") at all, so what it is missing is that commit rather than this
ordering fixup. It does not apply to 6.12 as-is either, because the
tegra241_cmdqv_destroy_vintf_user() hunk has no counterpart there.

Could one of you send an adapted 6.12.y version with that hunk dropped?

-- 
Thanks,
Sasha

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

Posted by Nicolin Chen 1 week, 2 days ago

On Mon, Sep 14, 2026 at 10:03:17PM -0400, Sasha Levin wrote:
> > Patch itself looks good to me for v7.2 stable and v6.8 longterm.
> 
> Queued for 6.18, thanks.
> 
> > But v6.12 longterm might need some extra fix, Sasha?
> 
> It does, but a different one. 6.12 has the devm teardown conversion and never
> got 9ff145a25c5c ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on
> teardown") at all, so what it is missing is that commit rather than this
> ordering fixup. It does not apply to 6.12 as-is either, because the
> tegra241_cmdqv_destroy_vintf_user() hunk has no counterpart there.
> 
> Could one of you send an adapted 6.12.y version with that hunk dropped?

Shameer, would you mind helping backport your patch onto 6.12.y?

Thanks
Nicolin

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

Posted by Sasha Levin 2 weeks ago

> The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
> into the implementation device_disable() callback.  However, its
> stable backport preceded the conversion to devm teardown and could
> only invoke the callback from the shutdown path.

This is a stable-only change for 7.2.y with no upstream commit to point at.
Since it has no Reviewed-by or Acked-by from an arm-smmu-v3 or tegra241-cmdqv
maintainer, we need that before queuing a stable-only fix.

Could you get a maintainer ack for this?

-- 
Thanks,
Sasha