On 2024-12-09 11:27 am, Sasha Levin wrote:

This is a note to let you know that I've just added the patch titled

 iommu/arm-smmu: Defer probe of clients after smmu device bound

to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...

The filename of the patch is: iommu-arm-smmu-defer-probe-of-clients-after-smmu-dev.patch and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.

FWIW the correct resolution for cherry-picking this directly is the logically-straightforward one, as below (git is mostly just confused by the context)

Cheers, Robin.

----->8----- diff --cc drivers/iommu/arm/arm-smmu/arm-smmu.c index d6d1a2a55cc0,14618772a3d6..000000000000 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@@ -1357,10 -1435,19 +1357,21 @@@ static struct iommu_device *arm_smmu_pr fwspec = dev_iommu_fwspec_get(dev); if (ret) goto out_free; - } else { + } else if (fwspec && fwspec->ops == &arm_smmu_ops) { smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); + + /* + * Defer probe if the relevant SMMU instance hasn't finished + * probing yet. This is a fragile hack and we'd ideally + * avoid this race in the core code. Until that's ironed + * out, however, this is the most pragmatic option on the + * table. + */ + if (!smmu) + return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, + "smmu dev has not bound yet\n")); + } else { + return ERR_PTR(-ENODEV); }

ret = -EINVAL;

commit 62dc845a353efab2254480df8ae7d06175627313 Author: Pratyush Brahma quic_pbrahma@quicinc.com Date: Fri Oct 4 14:34:28 2024 +0530

 iommu/arm-smmu: Defer probe of clients after smmu device bound
 
 [ Upstream commit 229e6ee43d2a160a1592b83aad620d6027084aad ]
 
 Null pointer dereference occurs due to a race between smmu
 driver probe and client driver probe, when of_dma_configure()
 for client is called after the iommu_device_register() for smmu driver
 probe has executed but before the driver_bound() for smmu driver
 has been called.
 
 Following is how the race occurs:
 
 T1:Smmu device probe            T2: Client device probe
 
 really_probe()
 arm_smmu_device_probe()
 iommu_device_register()
                                         really_probe()
                                         platform_dma_configure()
                                         of_dma_configure()
                                         of_dma_configure_id()
                                         of_iommu_configure()
                                         iommu_probe_device()
                                         iommu_init_device()
                                         arm_smmu_probe_device()
                                         arm_smmu_get_by_fwnode()
                                                 driver_find_device_by_fwnode()
                                                 driver_find_device()
                                                 next_device()
                                                 klist_next()
                                                     /* null ptr
                                                        assigned to smmu */
                                         /* null ptr dereference
                                            while smmu->streamid_mask */
 driver_bound()
         klist_add_tail()
 
 When this null smmu pointer is dereferenced later in
 arm_smmu_probe_device, the device crashes.
 
 Fix this by deferring the probe of the client device
 until the smmu device has bound to the arm smmu driver.
 
 Fixes: 021bb8420d44 ("iommu/arm-smmu: Wire up generic configuration support")
 Cc: stable@vger.kernel.org
 Co-developed-by: Prakash Gupta <quic_guptap@quicinc.com>
 Signed-off-by: Prakash Gupta <quic_guptap@quicinc.com>
 Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
 Link: https://lore.kernel.org/r/20241004090428.2035-1-quic_pbrahma@quicinc.com
 [will: Add comment]
 Signed-off-by: Will Deacon <will@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c index 8203a06014d71..b40ffa1ec2db6 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@ -1354,6 +1354,17 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) goto out_free; } else { smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);

• /*
  

•  * Defer probe if the relevant SMMU instance hasn't finished
  

•  * probing yet. This is a fragile hack and we'd ideally
  

•  * avoid this race in the core code. Until that's ironed
  

•  * out, however, this is the most pragmatic option on the
  

•  * table.
  

•  */
  

• if (!smmu)
  

• 	return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER,
  

• 				"smmu dev has not bound yet\n"));
  

  }

ret = -EINVAL;