Re: [PATCH v2 04/11] ARM: dma-mapping: Implement and expose DMA setup functions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm-iommu: missing owns_domain check in arm_iommu_attach_device causes kref warning
--

commit 9a5832f0c5c50cf332fad22584273f026af693a5
Author: Mikko Perttunen <mperttunen@nvidia.com>
ARM: dma-mapping: Implement and expose DMA setup functions

This commit allows the IOMMU core to allocate DMA domains and get the
cookie from the ARM DMA code. It implements ARM versions of
iommu_get_dma_cookie and iommu_put_dma_cookie.

> diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
> index 4284950a92469..f2d3e8ec34872 100644
> --- a/arch/arm/mm/dma-mapping.c
> +++ b/arch/arm/mm/dma-mapping.c

[ ... ]

> @@ -1660,6 +1742,14 @@ void arm_iommu_detach_device(struct device *dev)
>  		return;
>  	}
>  
> +	/*
> +	 * This pairs with arm_iommu_attach_device() on a driver-owned mapping.
> +	 * A mapping which is merely the cookie of a core-owned default domain
> +	 * must not be torn down from here.
> +	 */
> +	if (WARN_ON(!mapping->owns_domain))
> +		return;
> +

[Severity: High]
Should __arm_iommu_attach_device() also have a similar check for
!mapping->owns_domain?

Mappings created by the IOMMU core via iommu_get_dma_cookie() are
zero-initialized and bypass kref_init(), relying instead on the owns_domain
flag being false to prevent refcount operations.

If a legacy driver saves a device's original core-owned mapping during
initialization and later attempts to restore it by calling
arm_iommu_attach_device(), __arm_iommu_attach_device() will execute:

arch/arm/mm/dma-mapping.c:__arm_iommu_attach_device() {
	...
	err = iommu_attach_device(mapping->domain, dev);
	if (err)
		return err;

	kref_get(&mapping->kref);
	...
}

Calling kref_get() on a zero-initialized kref would trigger a refcount warning
traceback. Does __arm_iommu_attach_device() need a
WARN_ON(!mapping->owns_domain) check to prevent driver interactions with
core-owned mappings?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-b4-arm32-iommu-dma-cookie-v2-0-b06842a01938@nvidia.com?part=4