[PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

[PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

[Wentao Guan]

The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
into the implementation device_disable() callback. However, its stable
backport preceded the conversion to devm teardown and could only invoke
the callback from the shutdown path.

Now that arm_smmu_disable_action() manages normal teardown, invoke the
implementation callback there while the command queue is still alive.
This prevents the subsequent implementation remove action from releasing
resources while the CMDQV hardware remains active.

After ("iommu/arm-smmu-v3: Manage teardown with devm") merged in stable,
now keep the shutdown path consistent with mainline, where disabling
the base SMMU is sufficient.

It is a fix for stable tree commit to aligned with mainline, so no
upstream commit id here.

Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index c993e101fab3a..ea908afb0da9d 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4789,6 +4789,8 @@ static void arm_smmu_disable_action(void *data)
 {
 	struct arm_smmu_device *smmu = data;
 
+	if (smmu->impl_ops && smmu->impl_ops->device_disable)
+		smmu->impl_ops->device_disable(smmu);
 	arm_smmu_device_disable(smmu);
 }
 
@@ -5621,8 +5623,6 @@ static void arm_smmu_device_shutdown(struct platform_device *pdev)
 {
 	struct arm_smmu_device *smmu = platform_get_drvdata(pdev);
 
-	if (smmu->impl_ops && smmu->impl_ops->device_disable)
-		smmu->impl_ops->device_disable(smmu);
 	arm_smmu_device_disable(smmu);
 }
 
-- 
2.30.2

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

[Sasha Levin]

> The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
> into the implementation device_disable() callback.  However, its
> stable backport preceded the conversion to devm teardown and could
> only invoke the callback from the shutdown path.

This is a stable-only change for 7.2.y with no upstream commit to point at.
Since it has no Reviewed-by or Acked-by from an arm-smmu-v3 or tegra241-cmdqv
maintainer, we need that before queuing a stable-only fix.

Could you get a maintainer ack for this?

-- 
Thanks,
Sasha

RE: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Wentao Guan <guanwentao@uniontech.com>
> Sent: 10 September 2026 07:54
> To: sashal@kernel.org; Jason Gunthorpe <jgg@nvidia.com>
> Cc: will@kernel.org; linux-arm-kernel@lists.infradead.org;
> iommu@lists.linux.dev; stable@vger.kernel.org; linux-kernel@vger.kernel.org;
> Nicolin Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Wentao Guan <guanwentao@uniontech.com>
> Subject: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during
> devm teardown
> 
> External email: Use caution opening links or attachments
> 
> 
> The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
> into the implementation device_disable() callback. However, its stable
> backport preceded the conversion to devm teardown and could only invoke
> the callback from the shutdown path.
> 
> Now that arm_smmu_disable_action() manages normal teardown, invoke the
> implementation callback there while the command queue is still alive.
> This prevents the subsequent implementation remove action from releasing
> resources while the CMDQV hardware remains active.
> 
> After ("iommu/arm-smmu-v3: Manage teardown with devm") merged in
> stable,
> now keep the shutdown path consistent with mainline, where disabling
> the base SMMU is sufficient.
> 
> It is a fix for stable tree commit to aligned with mainline, so no
> upstream commit id here.
> 
> Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free
> on teardown")
> Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
> ---
>  drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> index c993e101fab3a..ea908afb0da9d 100644
> --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> @@ -4789,6 +4789,8 @@ static void arm_smmu_disable_action(void *data)
>  {
>         struct arm_smmu_device *smmu = data;
> 
> +       if (smmu->impl_ops && smmu->impl_ops->device_disable)
> +               smmu->impl_ops->device_disable(smmu);
>         arm_smmu_device_disable(smmu);
>  }
> 
> @@ -5621,8 +5623,6 @@ static void arm_smmu_device_shutdown(struct
> platform_device *pdev)
>  {
>         struct arm_smmu_device *smmu = platform_get_drvdata(pdev);
> 
> -       if (smmu->impl_ops && smmu->impl_ops->device_disable)
> -               smmu->impl_ops->device_disable(smmu);
>         arm_smmu_device_disable(smmu);
>  }

LGTM;

Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>

Thanks,
Shameer

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

[Nicolin Chen]

On Thu, Sep 10, 2026 at 02:54:29PM +0800, Wentao Guan wrote:
> The Tegra241 CMDQV teardown fix moved VINTF hardware deinitialization
> into the implementation device_disable() callback. However, its stable
> backport preceded the conversion to devm teardown and could only invoke
> the callback from the shutdown path.

Hmm, it did...

[correct in mainline]
git log --oneline v7.3-rc1 drivers/iommu/arm/arm-smmu-v3/
...
9ff145a25c5c8 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
2bd22a0d40503 iommu/arm-smmu-v3: Manage teardown with devm
...

[inverted in two trees]
git log --oneline v7.2.5 drivers/iommu/arm/arm-smmu-v3/
...
78fd5a2d65f35 iommu/arm-smmu-v3: Manage teardown with devm
f9b7375db3b36 iommu/arm-smmu-v3: Add HAFT support for SVA
5994617e09ee6 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
...

git log --oneline v6.18.51 drivers/iommu/arm/arm-smmu-v3/
...
2235eafda9b3d iommu/arm-smmu-v3: Manage teardown with devm
d903d99ffd22b iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
d2ab08437e913 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
...

[missing cmdqv fix]
git log --oneline v6.12.109 -33 drivers/iommu/arm/arm-smmu-v3/
...
981686f413776 iommu/arm-smmu-v3: Manage teardown with devm
...

Patch itself looks good to me for v7.2 stable and v6.8 longterm.

But v6.12 longterm might need some extra fix, Sasha?

> Now that arm_smmu_disable_action() manages normal teardown, invoke the
> implementation callback there while the command queue is still alive.
> This prevents the subsequent implementation remove action from releasing
> resources while the CMDQV hardware remains active.
> 
> After ("iommu/arm-smmu-v3: Manage teardown with devm") merged in stable,
> now keep the shutdown path consistent with mainline, where disabling
> the base SMMU is sufficient.
> 
> It is a fix for stable tree commit to aligned with mainline, so no
> upstream commit id here.
>
> Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
> Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

Acked-by: Nicolin Chen <nicolinc@nvidia.com>

Re: [PATCH 7.2.y] iommu/arm-smmu-v3: Disable implementations during devm teardown

[Sasha Levin]

> Now that arm_smmu_disable_action() manages normal teardown, invoke the
> implementation callback there while the command queue is still alive.
> This prevents the subsequent implementation remove action from releasing
> resources while the CMDQV hardware remains active.
>
> Fixes: 5994617e09ee ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
> Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

Queued for 7.2, thanks.

-- 
Thanks,
Sasha