From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D2F7328B5F; Fri, 9 Jan 2026 12:51:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767963100; cv=none; b=n/Lyyq6h+PYqY2+2mgRWP4ZTtdyW7WyWLjWbPKh8L+SKQ/tU8DwSB43IUntiuXHo3KcA/dOfP7qzd/sB7q4qEF9hvP/9Hsqf91jKskZm1GwNQN/bI8loyt2vJlB6b3cfbYx/gUw1TjV0NwtlmSFoKA9jJarnc1IxQOh0Kp/oJDg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767963100; c=relaxed/simple; bh=ue2ezh0xts8HXVrp/edm+lx7tNZ2Ee3SFHgayXWUR0A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rcNRUXZzE058T7GNqJJvSrAo/iFB50Y9aZ5td/HRZRL3Pvnc8jUIrQ6GC57cC4ClMjLqyo18kjDw6h4HPK6TQiKcSTQZwnH/M27dR9u7QdWg/B3/bEwDzUe9Ivf2cLgp8Qkq0tCvfa06TcCqiDZlaxyfeBwNSVKMBfSUp9+KlFo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0DAS380W; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0DAS380W" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 098DCC16AAE; Fri, 9 Jan 2026 12:51:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1767963099; bh=ue2ezh0xts8HXVrp/edm+lx7tNZ2Ee3SFHgayXWUR0A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0DAS380WutHIbfSRJhTg5+qCJPApn3VXX+igGe+WYyepZ8Xcu9DYm2Csd5kQY8m5A Uvam++GXHcoUY4h+RsChI18jPbyxc+ykNSWX0/sElLI3KMlamoEZhsHZqik2s/jCO0 5Tt2xqvq77tDRPSAvd5T2yoUy8FtGkX0BmaYbDgY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Guenter Roeck , Yong Wu , AngeloGioacchino Del Regno , Matthias Brugger , Joerg Roedel , Sasha Levin Subject: [PATCH 6.1 565/634] iommu/mediatek: Improve safety for mediatek,smi property in larb nodes Date: Fri, 9 Jan 2026 12:44:03 +0100 Message-ID: <20260109112138.863326170@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260109112117.407257400@linuxfoundation.org> References: <20260109112117.407257400@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yong Wu [ Upstream commit 6cde583d5352818a51985b32a960cdde85ab3821 ] No functional change. Just improve safety from dts. All the larbs that connect to one IOMMU must connect with the same smi-common. This patch checks all the mediatek,smi property for each larb, If their mediatek,smi are different, it will return fails. Also avoid there is no available smi-larb nodes. Suggested-by: Guenter Roeck Signed-off-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Link: https://lore.kernel.org/r/20221018024258.19073-6-yong.wu@mediatek.com Signed-off-by: Joerg Roedel Stable-dep-of: de83d4617f9f ("iommu/mediatek: fix use-after-free on probe deferral") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/iommu/mtk_iommu.c | 53 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 37 insertions(+), 16 deletions(-) --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -1048,7 +1048,7 @@ static const struct component_master_ops static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **match, struct mtk_iommu_data *data) { - struct device_node *larbnode, *smicomm_node, *smi_subcomm_node; + struct device_node *larbnode, *frst_avail_smicomm_node = NULL; struct platform_device *plarbdev, *pcommdev; struct device_link *link; int i, larb_nr, ret; @@ -1060,6 +1060,7 @@ static int mtk_iommu_mm_dts_parse(struct return -EINVAL; for (i = 0; i < larb_nr; i++) { + struct device_node *smicomm_node, *smi_subcomm_node; u32 id; larbnode = of_parse_phandle(dev->of_node, "mediatek,larbs", i); @@ -1100,27 +1101,47 @@ static int mtk_iommu_mm_dts_parse(struct goto err_larbdev_put; } + /* Get smi-(sub)-common dev from the last larb. */ + smi_subcomm_node = of_parse_phandle(larbnode, "mediatek,smi", 0); + if (!smi_subcomm_node) { + ret = -EINVAL; + goto err_larbdev_put; + } + + /* + * It may have two level smi-common. the node is smi-sub-common if it + * has a new mediatek,smi property. otherwise it is smi-commmon. + */ + smicomm_node = of_parse_phandle(smi_subcomm_node, "mediatek,smi", 0); + if (smicomm_node) + of_node_put(smi_subcomm_node); + else + smicomm_node = smi_subcomm_node; + + /* + * All the larbs that connect to one IOMMU must connect with the same + * smi-common. + */ + if (!frst_avail_smicomm_node) { + frst_avail_smicomm_node = smicomm_node; + } else if (frst_avail_smicomm_node != smicomm_node) { + dev_err(dev, "mediatek,smi property is not right @larb%d.", id); + of_node_put(smicomm_node); + ret = -EINVAL; + goto err_larbdev_put; + } else { + of_node_put(smicomm_node); + } + component_match_add(dev, match, component_compare_dev, &plarbdev->dev); platform_device_put(plarbdev); } - /* Get smi-(sub)-common dev from the last larb. */ - smi_subcomm_node = of_parse_phandle(larbnode, "mediatek,smi", 0); - if (!smi_subcomm_node) + if (!frst_avail_smicomm_node) return -EINVAL; - /* - * It may have two level smi-common. the node is smi-sub-common if it - * has a new mediatek,smi property. otherwise it is smi-commmon. - */ - smicomm_node = of_parse_phandle(smi_subcomm_node, "mediatek,smi", 0); - if (smicomm_node) - of_node_put(smi_subcomm_node); - else - smicomm_node = smi_subcomm_node; - - pcommdev = of_find_device_by_node(smicomm_node); - of_node_put(smicomm_node); + pcommdev = of_find_device_by_node(frst_avail_smicomm_node); + of_node_put(frst_avail_smicomm_node); if (!pcommdev) return -ENODEV; data->smicomm_dev = &pcommdev->dev;