Re: [PATCH 07/12] iommu: qcom_iommu: restore context bank state after power collapse

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free and hardware page table corruption due to dangling `ctx->domain` on initialization error path.
--

--- Patch [7]: [PATCH 07/12] iommu: qcom_iommu: restore context bank state after power collapse ---
commit 4c924588306637fe44ecea534620e5e790b49aa8
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

iommu: qcom_iommu: restore context bank state after power collapse

This commit caches the computed context bank register values at attach
time and replays the global reset, stream mapping and context bank
programming on runtime resume. Instances opt in through the new
ctx_restore configuration flag.

> diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
> index 3b07c4cf23fe1..8e9488c47d5c1 100644
> --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
> +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
[ ... ]
> @@ -1079,6 +1082,16 @@ static int __maybe_unused qcom_iommu_resume(struct device *dev)
>  			return ret;
>  	}
>  
> +	if (qcom_iommu->cfg && qcom_iommu->cfg->ctx_restore) {
> +		/* Restore context banks lost over power collapse */
> +		for (i = 0; i <= qcom_iommu->max_asid; i++) {
> +			struct qcom_iommu_ctx *ctx = qcom_iommu->ctxs[i];
> +
> +			if (ctx && ctx->domain && !ctx->secured_ctx)
> +				qcom_iommu_program_ctx(qcom_iommu, ctx);

[Severity: High]
This is a pre-existing issue, but could this new resume logic trigger a
use-after-free and corrupt hardware page tables if initialization previously
failed?

In drivers/iommu/arm/arm-smmu/qcom_iommu.c:qcom_iommu_init_domain(), the error
path frees the allocated page tables but fails to clear the ctx->domain pointer
for context banks that were successfully processed before the error occurred:

out_clear_iommu:
	free_io_pgtable_ops(pgtbl_ops);
	qcom_domain->iommu = NULL;

If a device with multiple context banks fails initialization midway (for example,
during a firmware SCM call for a subsequent bank), the error path leaves
ctx->domain dangling and the page tables freed.

Upon the next PM runtime resume, this new loop in qcom_iommu_resume() sees the
truthy ctx->domain and programs the hardware with the stale ctx->ttbr0, causing
the IOMMU to use freed memory for DMA translation page tables.

> +		}
> +	}
> +
>  	return ret;
>  }
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260809-msm8974-iommu-upstream-v1-0-87f5cd492560@oss.qualcomm.com?part=7