Re: [PATCH v4 4/5] iommu/vt-d: Fail probe on ATS configuration failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unconditional RB-tree removal on error path causes tree corruption for non-ATS devices.
--

commit b8810979b183c84268a61e16cca0cbf36d0ac97a
Author: Pranjal Shrivastava <praan@google.com>

iommu/vt-d: Fail probe on ATS configuration failure

Updates the Intel vt-d driver to strictly handle ats configuration by failing
the device probe if pci_prepare_ats() returns an error. It also throws a
warning if pci_enable_ats() fails during enablement, treating it as a bug.

> diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
> index 4d0e65bc131d7..22308e4911e1f 100644
> --- a/drivers/iommu/intel/iommu.c
> +++ b/drivers/iommu/intel/iommu.c
[ ... ]
> @@ -3288,7 +3294,10 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
>  
>  	dev_iommu_priv_set(dev, info);
>  	if (pdev && pci_ats_supported(pdev)) {
> -		pci_prepare_ats(pdev, VTD_PAGE_SHIFT);
> +		ret = pci_prepare_ats(pdev, VTD_PAGE_SHIFT);
> +		if (ret)
> +			goto free;
> +
>  		ret = device_rbtree_insert(iommu, info);
>  		if (ret)
>  			goto free;

[Severity: High]
This is a pre-existing issue, but does unconditional removal of the rb-node
on the error path cause tree corruption for non-ats devices?

If a device does not support ats, the info structure skips the
device_rbtree_insert() call here, leaving info->node zero-initialized.

However, if a subsequent operation like intel_pasid_alloc_table() fails,
the error path jumps to clear_rbtree:

intel_iommu_probe_device()
    ...
    clear_rbtree:
            device_rbtree_remove(info);
    free:
            kfree(info);

Calling device_rbtree_remove() on this zero-initialized node causes the
rb-tree logic to treat it as a root node with no parent, ultimately
overwriting the actual tree root with null and corrupting the device_rbtree.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525184347.4059549-1-praan@google.com?part=4