iommu: fix device leaks

---
 drivers/iommu/apple-dart.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/iommu/apple-dart.c +2 -0

index 95a4e62b8f63..9804022c7f59 100644
@@ -802,6 +802,8 @@ static int apple_dart_of_xlate(struct device *dev,
 	struct apple_dart *cfg_dart;
 	int i, sid;
 
+	put_device(&iommu_pdev->dev);
+
 	if (args->args_count != 1)
 		return -EINVAL;
 	sid = args->args[0];

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #2 lore raw

PATCH v3 2/14 iommu/qcom: fix device leak on of_xlate()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().

Note that commit e2eae09939a8 ("iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success and late failures.

Fixes 0ae349a0f33f ("iommu/qcom: Add qcom_iommu")

Cc [email protected] # 4.14: e2eae09939a8

Cc Rob Clark <[email protected]>

Cc Yu Kuai <[email protected]>

---
 drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

drivers/iommu/arm/arm-smmu/qcom_iommu.c +4 -6

index c5be95e56031..9c1166a3af6c 100644
@@ -565,14 +565,14 @@ static int qcom_iommu_of_xlate(struct device *dev,
 
 	qcom_iommu = platform_get_drvdata(iommu_pdev);
 
+	put_device(&iommu_pdev->dev);
+
 	/* make sure the asid specified in dt is valid, so we don't have
 	 * to sanity check this elsewhere:
 	 */
 	if (WARN_ON(asid > qcom_iommu->max_asid) ||
-	    WARN_ON(qcom_iommu->ctxs[asid] == NULL)) {
-		put_device(&iommu_pdev->dev);
+	    WARN_ON(qcom_iommu->ctxs[asid] == NULL))
 		return -EINVAL;
-	}
 
 	if (!dev_iommu_priv_get(dev)) {
 		dev_iommu_priv_set(dev, qcom_iommu);

@@ -581,10 +581,8 @@ static int qcom_iommu_of_xlate(struct device *dev,
 		 * multiple different iommu devices.  Multiple context
 		 * banks are ok, but multiple devices are not:
 		 */
-		if (WARN_ON(qcom_iommu != dev_iommu_priv_get(dev))) {
-			put_device(&iommu_pdev->dev);
+		if (WARN_ON(qcom_iommu != dev_iommu_priv_get(dev)))
 			return -EINVAL;
-		}
 	}
 
 	return iommu_fwspec_add_ids(dev, &asid, 1);

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #3 lore raw

PATCH v3 3/14 iommu/exynos: fix device leak on of_xlate()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().

Note that commit 1a26044954a6 ("iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success.

Fixes aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree")

Cc [email protected] # 4.2: 1a26044954a6

Cc Yu Kuai <[email protected]>

Acked-by Marek Szyprowski <[email protected]>

---
 drivers/iommu/exynos-iommu.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

drivers/iommu/exynos-iommu.c +3 -6

index b6edd178fe25..ce9e935cb84c 100644
@@ -1446,17 +1446,14 @@ static int exynos_iommu_of_xlate(struct device *dev,
 		return -ENODEV;
 
 	data = platform_get_drvdata(sysmmu);
-	if (!data) {
-		put_device(&sysmmu->dev);
+	put_device(&sysmmu->dev);
+	if (!data)
 		return -ENODEV;
-	}
 
 	if (!owner) {
 		owner = kzalloc(sizeof(*owner), GFP_KERNEL);
-		if (!owner) {
-			put_device(&sysmmu->dev);
+		if (!owner)
 			return -ENOMEM;
-		}
 
 		INIT_LIST_HEAD(&owner->controllers);
 		mutex_init(&owner->rpm_lock);

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #4 lore raw

PATCH v3 4/14 iommu/ipmmu-vmsa: fix device leak on of_xlate()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().

Fixes 7b2d59611fef ("iommu/ipmmu-vmsa: Replace local utlb code with fwspec ids")

Cc [email protected] # 4.14

Cc Magnus Damm <[email protected]>

---
 drivers/iommu/ipmmu-vmsa.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/iommu/ipmmu-vmsa.c +2 -0

index ffa892f65714..02a2a55ffa0a 100644
@@ -720,6 +720,8 @@ static int ipmmu_init_platform_device(struct device *dev,
 
 	dev_iommu_priv_set(dev, platform_get_drvdata(ipmmu_pdev));
 
+	put_device(&ipmmu_pdev->dev);
+
 	return 0;
 }

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #5 lore raw

PATCH v3 5/14 iommu/mediatek: fix device leak on of_xlate()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().

Fixes 0df4fabe208d ("iommu/mediatek: Add mt8173 IOMMU driver")

Cc [email protected] # 4.6

---
 drivers/iommu/mtk_iommu.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/iommu/mtk_iommu.c +2 -0

index 0e0285348d2b..8d8e85186188 100644
@@ -974,6 +974,8 @@ static int mtk_iommu_of_xlate(struct device *dev,
 			return -EINVAL;
 
 		dev_iommu_priv_set(dev, platform_get_drvdata(m4updev));
+
+		put_device(&m4updev->dev);
 	}
 
 	return iommu_fwspec_add_ids(dev, args->args, 1);

Signature · 1 line

2.49.1

AngeloGioacchino Del Regno

maintainer Reviewed-by on v3 5/14

2025-10-20 10:36 UTC #6 lore raw

Re: [PATCH v3 05/14] iommu/mediatek: fix device leak on of_xlate()

Il 20/10/25 06:53, Johan Hovold ha scritto:

Quoted 8 lines

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().
Fixes 0df4fabe208d ("iommu/mediatek: Add mt8173 IOMMU driver")
Cc [email protected] # 4.6
Acked-by Robin Murphy <[email protected]>
Reviewed-by Yong Wu <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Reviewed-by AngeloGioacchino Del Regno <[email protected]>

Johan Hovold

author

2025-10-20 04:56 UTC #7 lore raw

PATCH v3 6/14 iommu/mediatek: fix use-after-free on probe deferral

The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers.

Fix this by keeping the references as expected while the iommu driver is bound.

Fixes 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse")

Cc [email protected]

Cc Yong Wu <[email protected]>

---
 drivers/iommu/mtk_iommu.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

drivers/iommu/mtk_iommu.c +18 -7

index 8d8e85186188..64ce041238fd 100644
@@ -1213,16 +1213,19 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m
 		}
 
 		component_match_add(dev, match, component_compare_dev, &plarbdev->dev);
-		platform_device_put(plarbdev);
 	}
 
-	if (!frst_avail_smicomm_node)
-		return -EINVAL;
+	if (!frst_avail_smicomm_node) {
+		ret = -EINVAL;
+		goto err_larbdev_put;
+	}
 
 	pcommdev = of_find_device_by_node(frst_avail_smicomm_node);
 	of_node_put(frst_avail_smicomm_node);
-	if (!pcommdev)
-		return -ENODEV;
+	if (!pcommdev) {
+		ret = -ENODEV;
+		goto err_larbdev_put;
+	}
 	data->smicomm_dev = &pcommdev->dev;
 
 	link = device_link_add(data->smicomm_dev, dev,

@@ -1230,7 +1233,8 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m
 	platform_device_put(pcommdev);
 	if (!link) {
 		dev_err(dev, "Unable to link %s.\n", dev_name(data->smicomm_dev));
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_larbdev_put;
 	}
 	return 0;

@@ -1402,8 +1406,12 @@ static int mtk_iommu_probe(struct platform_device *pdev)
 	iommu_device_sysfs_remove(&data->iommu);
 out_list_del:
 	list_del(&data->list);
-	if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM))
+	if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) {
 		device_link_remove(data->smicomm_dev, dev);
+
+		for (i = 0; i < MTK_LARB_NR_MAX; i++)
+			put_device(data->larb_imu[i].dev);
+	}
 out_runtime_disable:
 	pm_runtime_disable(dev);
 	return ret;

@@ -1423,6 +1431,9 @@ static void mtk_iommu_remove(struct platform_device *pdev)
 	if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) {
 		device_link_remove(data->smicomm_dev, &pdev->dev);
 		component_master_del(&pdev->dev, &mtk_iommu_com_ops);
+
+		for (i = 0; i < MTK_LARB_NR_MAX; i++)
+			put_device(data->larb_imu[i].dev);
 	}
 	pm_runtime_disable(&pdev->dev);
 	for (i = 0; i < data->plat_data->banks_num; i++) {

Signature · 1 line

2.49.1

AngeloGioacchino Del Regno

maintainer Reviewed-by on v3 6/14

2025-10-20 10:35 UTC #8 lore raw

Re: [PATCH v3 06/14] iommu/mediatek: fix use-after-free on probe deferral

Il 20/10/25 06:53, Johan Hovold ha scritto:

Quoted 5 lines

The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers.

Quoted 8 lines

Fix this by keeping the references as expected while the iommu driver is bound.
Fixes 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse")
Cc [email protected]
Cc Yong Wu <[email protected]>
Acked-by Robin Murphy <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Reviewed-by AngeloGioacchino Del Regno <[email protected]>

Yong Wu (吴勇)

maintainer Reviewed-by on v3 6/14

2025-10-25 09:18 UTC #9 lore raw

Re: [PATCH v3 06/14] iommu/mediatek: fix use-after-free on probe deferral

Quoted 15 lines · Johan Hovold

External email : Please do not click links or open attachments until you have verified the sender or the content.
The driver is dropping the references taken to the larb devices during
probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet
been bound to its driver so that the iommu driver probe defers.
Fix this by keeping the references as expected while the iommu driver is
bound.

Quoted 7 lines

Fixes 26593928564c ("iommu/mediatek: Add error path for loop of
mm_dts_parse")
Cc [email protected]
Cc Yong Wu <[email protected]>
Acked-by Robin Murphy <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---

Johan Hovold

author

2025-10-20 04:56 UTC #10 lore raw

PATCH v3 7/14 iommu/mediatek: simplify dt parsing error handling

As previously documented by commit 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse"), the id mapping may not be linear so the whole larb array needs to be iterated on devicetree parsing errors.

Simplify the loop by iterating from index zero while dropping the redundant NULL check for consistency with later cleanups.

Also add back the comment which was removed by commit 462e768b55a2 ("iommu/mediatek: Fix forever loop in error handling") to prevent anyone from trying to optimise the loop by iterating backwards from 'i'.

Cc Yong Wu <[email protected]>

---
 drivers/iommu/mtk_iommu.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

drivers/iommu/mtk_iommu.c +3 -4

index 64ce041238fd..f21cd3766069 100644
@@ -1239,11 +1239,10 @@ static int mtk_iommu_mm_dts_parse(struct device *dev, struct component_match **m
 	return 0;
 
 err_larbdev_put:
-	for (i = MTK_LARB_NR_MAX - 1; i >= 0; i--) {
-		if (!data->larb_imu[i].dev)
-			continue;
+	/* id mapping may not be linear, loop the whole array */
+	for (i = 0; i < MTK_LARB_NR_MAX; i++)
 		put_device(data->larb_imu[i].dev);
-	}
+
 	return ret;
 }

Signature · 1 line

2.49.1

AngeloGioacchino Del Regno

maintainer Reviewed-by on v3 7/14

2025-10-20 10:35 UTC #11 lore raw

Re: [PATCH v3 07/14] iommu/mediatek: simplify dt parsing error handling

Il 20/10/25 06:53, Johan Hovold ha scritto:

Quoted 8 lines

As previously documented by commit 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse"), the id mapping may not be linear so the whole larb array needs to be iterated on devicetree parsing errors.
Simplify the loop by iterating from index zero while dropping the redundant NULL check for consistency with later cleanups.

Quoted 7 lines

Also add back the comment which was removed by commit 462e768b55a2 ("iommu/mediatek: Fix forever loop in error handling") to prevent anyone from trying to optimise the loop by iterating backwards from 'i'.
Cc Yong Wu <[email protected]>
Acked-by Robin Murphy <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Reviewed-by AngeloGioacchino Del Regno <[email protected]>

Yong Wu (吴勇)

maintainer Reviewed-by on v3 7/14

2025-10-25 09:18 UTC #12 lore raw

Re: [PATCH v3 07/14] iommu/mediatek: simplify dt parsing error handling

Quoted 13 lines · Johan Hovold

External email : Please do not click links or open attachments until you have verified the sender or the content.
As previously documented by commit 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse"), the id mapping may not be linear
so the whole larb array needs to be iterated on devicetree parsing errors.
Simplify the loop by iterating from index zero while dropping the redundant NULL check for consistency with later cleanups.

Quoted 8 lines

Also add back the comment which was removed by commit 462e768b55a2 ("iommu/mediatek: Fix forever loop in error handling") to prevent anyone
from trying to optimise the loop by iterating backwards from 'i'.
Cc Yong Wu <[email protected]>
Acked-by Robin Murphy <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Johan Hovold

author

2025-10-20 04:56 UTC #13 lore raw

PATCH v3 8/14 iommu/mediatek-v1: fix device leak on probe_device()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device().

Fixes b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")

Cc [email protected] # 4.8

Cc Honghui Zhang <[email protected]>

---
 drivers/iommu/mtk_iommu_v1.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/iommu/mtk_iommu_v1.c +2 -0

index 10cc0b1197e8..de9153c0a82f 100644
@@ -435,6 +435,8 @@ static int mtk_iommu_v1_create_mapping(struct device *dev,
 			return -EINVAL;
 
 		dev_iommu_priv_set(dev, platform_get_drvdata(m4updev));
+
+		put_device(&m4updev->dev);
 	}
 
 	ret = iommu_fwspec_add_ids(dev, args->args, 1);

Signature · 1 line

2.49.1

AngeloGioacchino Del Regno

maintainer Reviewed-by on v3 8/14

2025-10-20 10:35 UTC #14 lore raw

Re: [PATCH v3 08/14] iommu/mediatek-v1: fix device leak on probe_device()

Il 20/10/25 06:53, Johan Hovold ha scritto:

Quoted 9 lines

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device().
Fixes b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
Cc [email protected] # 4.8
Cc Honghui Zhang <[email protected]>
Acked-by Robin Murphy <[email protected]>
Reviewed-by Yong Wu <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Reviewed-by AngeloGioacchino Del Regno <[email protected]>

Johan Hovold

author

2025-10-20 04:56 UTC #15 lore raw

PATCH v3 9/14 iommu/mediatek-v1: fix device leaks on probe()

Make sure to drop the references taken to the larb devices during probe on probe failure (e.g. probe deferral) and on driver unbind.

Fixes b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")

Cc [email protected] # 4.8

Cc Honghui Zhang <[email protected]>

---
 drivers/iommu/mtk_iommu_v1.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

drivers/iommu/mtk_iommu_v1.c +18 -5

index de9153c0a82f..44b965a2db92 100644
@@ -648,8 +648,10 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
 		struct platform_device *plarbdev;
 
 		larbnode = of_parse_phandle(dev->of_node, "mediatek,larbs", i);
-		if (!larbnode)
-			return -EINVAL;
+		if (!larbnode) {
+			ret = -EINVAL;
+			goto out_put_larbs;
+		}
 
 		if (!of_device_is_available(larbnode)) {
 			of_node_put(larbnode);

@@ -659,11 +661,14 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
 		plarbdev = of_find_device_by_node(larbnode);
 		if (!plarbdev) {
 			of_node_put(larbnode);
-			return -ENODEV;
+			ret = -ENODEV;
+			goto out_put_larbs;
 		}
 		if (!plarbdev->dev.driver) {
 			of_node_put(larbnode);
-			return -EPROBE_DEFER;
+			put_device(&plarbdev->dev);
+			ret = -EPROBE_DEFER;
+			goto out_put_larbs;
 		}
 		data->larb_imu[i].dev = &plarbdev->dev;

@@ -675,7 +680,7 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
 
 	ret = mtk_iommu_v1_hw_init(data);
 	if (ret)
-		return ret;
+		goto out_put_larbs;
 
 	ret = iommu_device_sysfs_add(&data->iommu, &pdev->dev, NULL,
 				     dev_name(&pdev->dev));

@@ -697,12 +702,17 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
 	iommu_device_sysfs_remove(&data->iommu);
 out_clk_unprepare:
 	clk_disable_unprepare(data->bclk);
+out_put_larbs:
+	for (i = 0; i < MTK_LARB_NR_MAX; i++)
+		put_device(data->larb_imu[i].dev);
+
 	return ret;
 }
 
 static void mtk_iommu_v1_remove(struct platform_device *pdev)
 {
 	struct mtk_iommu_v1_data *data = platform_get_drvdata(pdev);
+	int i;
 
 	iommu_device_sysfs_remove(&data->iommu);
 	iommu_device_unregister(&data->iommu);

@@ -710,6 +720,9 @@ static void mtk_iommu_v1_remove(struct platform_device *pdev)
 	clk_disable_unprepare(data->bclk);
 	devm_free_irq(&pdev->dev, data->irq, data);
 	component_master_del(&pdev->dev, &mtk_iommu_v1_com_ops);
+
+	for (i = 0; i < MTK_LARB_NR_MAX; i++)
+		put_device(data->larb_imu[i].dev);
 }
 
 static int __maybe_unused mtk_iommu_v1_suspend(struct device *dev)

Signature · 1 line

2.49.1

AngeloGioacchino Del Regno

maintainer Reviewed-by on v3 9/14

2025-10-20 10:35 UTC #16 lore raw

Re: [PATCH v3 09/14] iommu/mediatek-v1: fix device leaks on probe()

Il 20/10/25 06:53, Johan Hovold ha scritto:

Quoted 8 lines

Make sure to drop the references taken to the larb devices during probe on probe failure (e.g. probe deferral) and on driver unbind.
Fixes b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
Cc [email protected] # 4.8
Cc Honghui Zhang <[email protected]>
Acked-by Robin Murphy <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Reviewed-by AngeloGioacchino Del Regno <[email protected]>

Johan Hovold

author

2025-10-20 04:56 UTC #17 lore raw

PATCH v3 10/14 iommu/mediatek-v1: add missing larb count sanity check

Add the missing larb count sanity check to avoid writing beyond a fixed sized array in case of a malformed devicetree.

---
 drivers/iommu/mtk_iommu_v1.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/iommu/mtk_iommu_v1.c +3 -0

index 44b965a2db92..55d6615a41a9 100644
@@ -643,6 +643,9 @@ static int mtk_iommu_v1_probe(struct platform_device *pdev)
 	if (larb_nr < 0)
 		return larb_nr;
 
+	if (larb_nr > MTK_LARB_NR_MAX)
+		return -EINVAL;
+
 	for (i = 0; i < larb_nr; i++) {
 		struct device_node *larbnode;
 		struct platform_device *plarbdev;

Signature · 1 line

2.49.1

AngeloGioacchino Del Regno

maintainer Reviewed-by on v3 10/14

2025-10-20 10:35 UTC #18 lore raw

Re: [PATCH v3 10/14] iommu/mediatek-v1: add missing larb count sanity check

Il 20/10/25 06:53, Johan Hovold ha scritto:

Quoted 6 lines

Add the missing larb count sanity check to avoid writing beyond a fixed sized array in case of a malformed devicetree.
Acked-by Robin Murphy <[email protected]>
Reviewed-by Yong Wu <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Reviewed-by AngeloGioacchino Del Regno <[email protected]>

Johan Hovold

author

2025-10-20 04:56 UTC #19 lore raw

PATCH v3 11/14 iommu/omap: fix device leaks on probe_device()

Make sure to drop the references taken to the iommu platform devices when looking up their driver data during probe_device().

Note that the arch data device pointer added by commit 604629bcb505 ("iommu/omap: add support for late attachment of iommu devices") has never been used. Remove it to underline that the references are not needed.

Fixes 9d5018deec86 ("iommu/omap: Add support to program multiple iommus")

Fixes 7d6827748d54 ("iommu/omap: Fix iommu archdata name for DT-based devices")

Cc [email protected] # 3.18

Cc Suman Anna <[email protected]>

---
 drivers/iommu/omap-iommu.c | 2 +-
 drivers/iommu/omap-iommu.h | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

drivers/iommu/omap-iommu.c +1 -1

index 5c6f5943f44b..c0315c86cd18 100644
@@ -1675,6 +1675,7 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 		}
 
 		oiommu = platform_get_drvdata(pdev);
+		put_device(&pdev->dev);
 		if (!oiommu) {
 			of_node_put(np);
 			kfree(arch_data);

@@ -1682,7 +1683,6 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 		}
 
 		tmp->iommu_dev = oiommu;
-		tmp->dev = &pdev->dev;
 
 		of_node_put(np);
 	}

drivers/iommu/omap-iommu.h +0 -2

index 27697109ec79..50b39be61abc 100644
@@ -88,7 +88,6 @@ struct omap_iommu {
 /**
  * struct omap_iommu_arch_data - omap iommu private data
  * @iommu_dev: handle of the OMAP iommu device
- * @dev: handle of the iommu device
  *
  * This is an omap iommu private data object, which binds an iommu user
  * to its iommu device. This object should be placed at the iommu user's

@@ -97,7 +96,6 @@ struct omap_iommu {
  */
 struct omap_iommu_arch_data {
 	struct omap_iommu *iommu_dev;
-	struct device *dev;
 };
 
 struct cr_regs {

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #20 lore raw

PATCH v3 12/14 iommu/omap: simplify probe_device() error handling

Simplify the probe_device() error handling by dropping the iommu OF node reference sooner.

---
 drivers/iommu/omap-iommu.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

drivers/iommu/omap-iommu.c +1 -4

index c0315c86cd18..7bbc6928c8d0 100644
@@ -1668,8 +1668,8 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 		}
 
 		pdev = of_find_device_by_node(np);
+		of_node_put(np);
 		if (!pdev) {
-			of_node_put(np);
 			kfree(arch_data);
 			return ERR_PTR(-ENODEV);
 		}

@@ -1677,14 +1677,11 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev)
 		oiommu = platform_get_drvdata(pdev);
 		put_device(&pdev->dev);
 		if (!oiommu) {
-			of_node_put(np);
 			kfree(arch_data);
 			return ERR_PTR(-EINVAL);
 		}
 
 		tmp->iommu_dev = oiommu;
-
-		of_node_put(np);
 	}
 
 	dev_iommu_priv_set(dev, arch_data);

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #21 lore raw

PATCH v3 13/14 iommu/sun50i: fix device leak on of_xlate()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate().

Fixes 4100b8c229b3 ("iommu: Add Allwinner H6 IOMMU driver")

Cc [email protected] # 5.8

Cc Maxime Ripard <[email protected]>

---
 drivers/iommu/sun50i-iommu.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/iommu/sun50i-iommu.c +2 -0

index de10b569d9a9..6306570d57db 100644
@@ -839,6 +839,8 @@ static int sun50i_iommu_of_xlate(struct device *dev,
 
 	dev_iommu_priv_set(dev, platform_get_drvdata(iommu_pdev));
 
+	put_device(&iommu_pdev->dev);
+
 	return iommu_fwspec_add_ids(dev, &id, 1);
 }

Signature · 1 line

2.49.1

Johan Hovold

author

2025-10-20 04:56 UTC #22 lore raw

PATCH v3 14/14 iommu/tegra: fix device leak on probe_device()

Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device().

Note that commit 9826e393e4a8 ("iommu/tegra-smmu: Fix missing put_device() call in tegra_smmu_find") fixed the leak in an error path, but the reference is still leaking on success.

Fixes 891846516317 ("memory: Add NVIDIA Tegra memory controller support")

Cc [email protected] # 3.19: 9826e393e4a8

Cc Miaoqian Lin <[email protected]>

Acked-by Thierry Reding <[email protected]>

---
 drivers/iommu/tegra-smmu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

drivers/iommu/tegra-smmu.c +2 -3

index 36cdd5fbab07..f6f26a072820 100644
@@ -830,10 +830,9 @@ static struct tegra_smmu *tegra_smmu_find(struct device_node *np)
 		return NULL;
 
 	mc = platform_get_drvdata(pdev);
-	if (!mc) {
-		put_device(&pdev->dev);
+	put_device(&pdev->dev);
+	if (!mc)
 		return NULL;
-	}
 
 	return mc->smmu;
 }

Signature · 1 line

2.49.1

Johan Hovold

author

2025-11-10 09:14 UTC #23 lore raw

Quoted 17 lines · Johan Hovold

This series fixes device leaks in the iommu drivers, which pretty consistently failed to drop the reference taken by of_find_device_by_node() when looking up iommu platform devices.
Included are also a couple of related cleanups.
Changes in v3
- fix mediatek use-after-free on probe deferral
- add acks and reviewed-bys from Marek, Yong and Thierry
Changes in v2
- drop omap reference sooner; remove unused pointer
- amend exynos commit message with reference to partial fix
- amend tegra commit message with reference to partial fix
- add Robin's ack

Quoted 15 lines

Johan Hovold (14):
iommu/apple-dart: fix device leak on of_xlate() iommu/qcom: fix device leak on of_xlate() iommu/exynos: fix device leak on of_xlate() iommu/ipmmu-vmsa: fix device leak on of_xlate() iommu/mediatek: fix device leak on of_xlate() iommu/mediatek: fix use-after-free on probe deferral iommu/mediatek: simplify dt parsing error handling iommu/mediatek-v1: fix device leak on probe_device() iommu/mediatek-v1: fix device leaks on probe() iommu/mediatek-v1: add missing larb count sanity check iommu/omap: fix device leaks on probe_device() iommu/omap: simplify probe_device() error handling iommu/sun50i: fix device leak on of_xlate() iommu/tegra: fix device leak on probe_device()

Can these be picked up for 6.19?

Johan

Joerg Roedel

maintainer Applied

2025-11-17 09:05 UTC #24 lore raw