Re: [PATCH 2/7] iommu/arm-smmu-v3: Prevent rbtree corruption from duplicate streams

[Nicolin Chen <nicolinc@nvidia.com>]

On Fri, Aug 28, 2026 at 12:53:37PM +0000, Mostafa Saleh wrote:
> In handling PCI devices with duplicate IDs, arm_smmu_insert_master()
> will continue the loop skipping the duplicate sids insertion in the
> rbtree.
> However, in the error path of arm_smmu_insert_master() and in
> arm_smmu_remove_master(), the code loops over all fwspec->num_ids and
> calls rb_erase() unconditionally.
> 
> For the duplicate streams, the node is zero allocated including the
> parent pointer "__rb_parent_color". That means rb_erase() will think
> that this node is root and it will corrupt the tree which includes
> other masters not being removed.
> 
> Fix this by initializing those nodes with RB_CLEAR_NODE() and check
> if they are empty before erasing.
> 
> Fixes: cdf315f907d4 ("iommu/arm-smmu-v3: Maintain a SID->device structure")
> Reported-by: Sashiko <>
> Signed-off-by: Mostafa Saleh <smostafa@google.com>

I submitted a similar patch a while ago :)
https://lore.kernel.org/linux-iommu/9136477b9c737a50cecc38f2ee6704a01510169a.1783044582.git.nicolinc@nvidia.com/

And I think the fix tag, as mine posted, should be:
Fixes: b00d24997a11 ("iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids")

Before that commit, a duplicated SID gets -EINVAL and errors out.

Thanks
Nicolin