Re: [PATCH RFC v5 2/6] iommu/arm-smmu-v3: Allocate streams individually

[Robin Murphy <robin.murphy@arm.com>]

On 08/10/2026 12:17 am, Nicolin Chen wrote:
> On Tue, Oct 06, 2026 at 08:19:08PM +0800, Peng Fan (OSS) wrote:
>> From: Peng Fan <peng.fan@nxp.com>
>>
>> Change master->streams from an embedded array of struct arm_smmu_stream
>> to an array of pointers, with each stream individually allocated.
>>
>> Prepare for shared-SID support where multiple masters will point to the
>> same stream object. With embedded structs, sharing requires duplicating
>> stream state and manually keeping fields like ste_installed in sync.
>> With individually allocated streams, a sharing master can simply point to
>> the existing stream.
>>
>> The sort comparator is updated to dereference the pointer indirection.
>>
>> No functional change.
>>
>> Suggested-by: Nicolin Chen <nicolinc@nvidia.com>
>> Link: https://lore.kernel.org/linux-iommu/arG6hmng3NddGEHm@nvidia.com/
>> Assisted-by: LLM
>> Signed-off-by: Peng Fan <peng.fan@nxp.com>
> 
> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
> 
>> diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
>> index 6644075c1431e..bc62a3d5a63f9 100644
>> --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
>> +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
>> @@ -1257,7 +1257,7 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev)
>>   	struct arm_smmu_master *master = dev_iommu_priv_get(dev);
>>   	struct tegra241_vintf *vintf = viommu_to_vintf(vdev->viommu);
>>   	struct tegra241_vintf_sid *vsid = vdev_to_vsid(vdev);
>> -	struct arm_smmu_stream *stream = &master->streams[0];
>> +	struct arm_smmu_stream *stream = master->streams[0];
> 
> Sashiko raised a concern of an out-of-bounds pointer dereference.
> 
> Though it's practically not possible, probably it would be safer
> to move this behind the check:
> 
> 	if (master->num_streams != 1)
> 		return -EOPNOTSUPP;

The IORT path unconditionally adds 1 ID via acpi_iommu_fwspec_init(), so 
num_streams==0 could only potentially happen with DT if a fwspec was 
parsed using #iommu-cells==0, except arm_smmu_device_dt_probe() would 
refuse to probe the entire SMMU if that was anything other than 1, so 
no, this definitely cannot ever be out of bounds.

Thanks,
Robin.