From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-100.freemail.mail.aliyun.com (out30-100.freemail.mail.aliyun.com [115.124.30.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E0A43368B1 for ; Sun, 26 Jul 2026 07:43:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.100 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785051828; cv=none; b=cahkLaqzsGae8piCY5fjg8LFNn2aaSgD0PbsoRYhsQY350607JWVsboHhygTfFsjYKdoM1+xSuSlXibOvyRBj6EC3s7zyw13th2KkTbyzUcFWheg1aACqHGoS0YBqrfheOPG2ESdr931LkueCmpNkn6p7wtTvJkIJFTJSOMvijk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785051828; c=relaxed/simple; bh=rX23anuRm7/SV4zM1LsThFTYYmUKuhtA/Q8SO2mvdSs=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=R8lagCcWWsqqcQ61Xv38A+VIey2u1UUdg1nm337Vw3R8CYlbwtx6yCNl2Wy1N3XvC3rlsoDuPnRyvTQBZY+3hHx4+C17ZPjGanKfzaEF4cm2GW9Mw2F9SK/3zlUPqw7PBLRYYjccr45z3SPWKTmjBsULXVpciOlwoKI+BlmdT/U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=T19C5kS2; arc=none smtp.client-ip=115.124.30.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="T19C5kS2" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1785051816; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=q0kp//E9FrXAKe+p3yGv6DuibFFV0Uf3nPCQs9TUpjY=; b=T19C5kS2/HYtK1L/gEtLc9+C/H8ivgMt8FZakPl66eKsracj/lZhx0Mo/iGEpRIBtO7uPKiTDfd6sM0Mf9eleWQ3osjN9Fd3i0R4hJb1m1xSgMusyGGtUUCf+VVaPKLEWiTjFhRRQri8M4IEwM/Z8w9X0Ab+HmTg659QdJGXRgU= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R101e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033045098064;MF=xueshuai@linux.alibaba.com;NM=1;PH=DS;RN=10;SR=0;TI=SMTPD_---0X7n2n9p_1785051814; Received: from localhost.localdomain(mailfrom:xueshuai@linux.alibaba.com fp:SMTPD_---0X7n2n9p_1785051814 cluster:ay36) by smtp.aliyun-inc.com; Sun, 26 Jul 2026 15:43:35 +0800 From: Shuai Xue To: joro@8bytes.org, will@kernel.org, robin.murphy@arm.com, jgg@ziepe.ca, kevin.tian@intel.com Cc: iommu@lists.linux.dev, linux-kernel@vger.kernel.org, oliver.yang@linux.alibaba.com, zhuo.song@linux.alibaba.com, xueshuai@linux.alibaba.com Subject: [PATCH 0/4] iommu: Fix SVA, iommufd, and iommupt error paths Date: Sun, 26 Jul 2026 15:43:28 +0800 Message-Id: X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This series fixes four independent error-path/lifetime issues in the IOMMU core helpers, iommufd, and generic page table code. Patch 1 fixes an SVA race where an attach handle becomes visible before handle->dev is initialized. A racing bind can reuse the handle and later unbind can dereference a NULL handle->dev. Patches 2 and 3 fix iommufd reference/lock leaks. Patch 2 avoids taking an object reference for internal accesses that are skipped by the unmap notification path. Patch 3 releases the current IOAS rwsem and object reference if xa_store() fails before the IOAS is inserted into the unwind list. Patch 4 fixes the generic page table iova_to_phys() op to return 0 on range validation failures. Returning a negative errno from a phys_addr_t function can make callers consume a bogus physical address. All patches are small fixes with Fixes tags and Cc: stable. Shuai Xue (4): iommu/sva: Set handle->dev before the SVA handle is visible iommufd: Avoid locking internal accesses during unmap iommufd: Release current IOAS on xa_store() failure iommupt: Return zero for invalid iova_to_phys() ranges drivers/iommu/generic_pt/iommu_pt.h | 2 +- drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommufd/device.c | 4 ++-- drivers/iommu/iommufd/ioas.c | 2 ++ 4 files changed, 6 insertions(+), 4 deletions(-) -- 2.39.3