[PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

Pranjal Shrivastava
2026-03-25T09:46:41Z

syzbot found that allocating a mock domain with AMDV1 format could
cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
providing the required driver_ops.

Initialize a spinlock (top_lock) and dummy callbacks in the mock
driver to satisfy the generic PT requirements.

Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op")
Reported-by: syzbot+453eb7add07c3767adab@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69c1d50b.a70a0220.3cae05.0001.GAE@google.com/
Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
drivers/iommu/iommufd/selftest.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)

diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
index 9607416f8069..960c5aee4a09 100644
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -119,6 +119,7 @@ struct mock_iommu_domain {
struct pt_iommu_amdv1 amdv1;
};
unsigned long flags;
+ spinlock_t top_lock;
};
PT_IOMMU_CHECK_DOMAIN(struct mock_iommu_domain, iommu, domain);
PT_IOMMU_CHECK_DOMAIN(struct mock_iommu_domain, amdv1.iommu, domain);
@@ -129,6 +130,26 @@ to_mock_domain(struct iommu_domain *domain)
return container_of(domain, struct mock_iommu_domain, domain);
}

+static void mock_domain_change_top(struct pt_iommu *iommu_table,
+ phys_addr_t top_paddr,
+ unsigned int top_level)
+{
+ /* The selftest doesn't have real hardware */
+}
+
+static spinlock_t *mock_domain_get_top_lock(struct pt_iommu *iommu_table)
+{
+ struct mock_iommu_domain *mock =
+ container_of(iommu_table, struct mock_iommu_domain, iommu);
+
+ return &mock->top_lock;
+}
+
+static const struct pt_iommu_driver_ops mock_driver_ops = {
+ .change_top = &mock_domain_change_top,
+ .get_top_lock = &mock_domain_get_top_lock,
+};
+
struct mock_iommu_domain_nested {
struct iommu_domain domain;
struct mock_viommu *mock_viommu;
@@ -445,6 +466,8 @@ mock_domain_alloc_pgtable(struct device *dev,
if (!mock)
return ERR_PTR(-ENOMEM);
mock->domain.type = IOMMU_DOMAIN_UNMANAGED;
+ spin_lock_init(&mock->top_lock);
+ mock->amdv1.iommu.driver_ops = &mock_driver_ops;

mock->amdv1.iommu.nid = NUMA_NO_NODE;

--
2.53.0.1018.g2bb0e51243-goog