From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f73.google.com (mail-pj1-f73.google.com [209.85.216.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF7A33BE621 for ; Mon, 1 Jun 2026 14:36:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780324616; cv=none; b=pxfJduuBio1fvRORSDKQ2pu9F9kqrZyJi+65tuTVB92Peqv33bixzWFMt/4DVVcQgg5m16nPpF/7zVNHPSXUgKC/UtVkXvatse+Lz4tqQjzun4MGHbsxZHTakiurWLxGVv8xRHp1L+HOzyKozUVDpOINH1iuPqGm/38NWXPGbko= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780324616; c=relaxed/simple; bh=ZY1CHI2qLE7gvcNu09TeXmB6q3EuV2tMfE05QxQiulQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=hwDIbJfIhwD21Vod+J6lnPIwYuLJIL+PEqnlkF6lilb0lnUmzNNQl4cceep+ntaJXs9Kiy0jrycdtL1WXD6YtmVWgLgzvXZVD7/+HLiXZW3gyl31M/j8i8T9k5LLukEmKVUy6Wcr2OcwjCHYtxx+dP54L1Ly7yI3Dzvl2vQUwpU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--praan.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Y3lcZCDl; arc=none smtp.client-ip=209.85.216.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--praan.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Y3lcZCDl" Received: by mail-pj1-f73.google.com with SMTP id 98e67ed59e1d1-36d8719bae6so1398571a91.3 for ; Mon, 01 Jun 2026 07:36:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780324613; x=1780929413; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=J1VlFw02VkFXjGZD0LXM1rfEtalYzEU51knuxCZNQpI=; b=Y3lcZCDl1kDBStCHLH0UqlGSbpkNQUnS3rQrug9CN6eEE8nHQM1XNzajFokwXhaoPr cOkDxPSTcbzmAlf+xA+3jao8A/coSRnQdV+hL7pHG7CdEJpkpklq4iOWYvLqKqXFD8KV ovDf/bRBUSAxDOzSvjLqnR89wZjNDjsbynb7skFYi591ymsRKtGP7lIfuhtY3YzOOXBG UILNPdcGQ4lJuj40Bbr9GTdrcvrTCkAIctuL3oy8dG+NnUV5a1PRsay0goSTxnWZ32jP KUIFfR+4SnC5+I5jVGR+HJCWwG5hku/9plBR4JtLya804bEI/UorurMAyMrQ9h7pkF08 oQvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780324613; x=1780929413; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=J1VlFw02VkFXjGZD0LXM1rfEtalYzEU51knuxCZNQpI=; b=Vfts/FrChQAMzvYhceb3mvKLmAz9ia/ENkcPKbCUxqv6OXZhOUINL7hWUmtZfZTlU7 ARr1ZARA47zcMLNRayRfwLQdyAr71kcRkFV/gLYY5gmuIGxVbxG1q3i/wv9VvZ054CSA Na1VShR9uO8pQRmxYBD1An/ZrCtMd8WEldWqIJK/gYmFtP1PD056eFUVGC5RQIFi7fqD w8UNul7MQs29Pa1s+qiF+C8jT1ehDQd9elcvdSWcfTYBvQOM+OZQ2ik11bnrdLiB0r5h 1/7kMq3n+cpAoZ/F+FJ2Drvs7XTfkwqI/vF7BSd1YD0OdYdfWt9rvi9vhGlXSwGoayF8 BaTg== X-Forwarded-Encrypted: i=1; AFNElJ+SVlFvUSl5d5tJWj05o2AhLm3+10cQGKHvroWzXa1VFlNg+g7BTLl7zB7nXfdXrYVoGDOye/enxPgIPlg=@vger.kernel.org X-Gm-Message-State: AOJu0YzXrJuHaW2r8K/fssxDmdKqOk7n/kxLca63Pm7KBxcbYiVACZvF yB5PqaffJ2DKzdFcO6nkXjr0L97ao+aGHiHKL7m6EjGJ1VCbe5P2G/H1rpEwi5n1GOuCwgiWyiB sRg== X-Received: from pjnj13.prod.google.com ([2002:a17:90a:840d:b0:368:eea2:5650]) (user=praan job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:2c84:b0:36b:9faf:8396 with SMTP id 98e67ed59e1d1-36c4ff6b3cdmr10066002a91.11.1780324612870; Mon, 01 Jun 2026 07:36:52 -0700 (PDT) Date: Mon, 1 Jun 2026 14:36:42 +0000 In-Reply-To: <20260601143644.2358771-1-praan@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260601143644.2358771-1-praan@google.com> X-Mailer: git-send-email 2.54.0.823.g6e5bcc1fc9-goog Message-ID: <20260601143644.2358771-4-praan@google.com> Subject: [PATCH v7 3/5] iommu/arm-smmu-v3: Fix a UAF in the probe_device error path From: Pranjal Shrivastava To: iommu@lists.linux.dev, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Joerg Roedel , Will Deacon , Robin Murphy , Baolu Lu , Jason Gunthorpe , Kevin Tian , Bjorn Helgaas , Samiullah Khawaja , Pranjal Shrivastava Content-Type: text/plain; charset="UTF-8" Clear the iommu->priv to NULL while returning an error from probe_device. Fixes: a2be6218e649 ("iommu/arm-smmu-v3: Improve add_device() error handling") Signed-off-by: Pranjal Shrivastava --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index a10affb483a4..54c7f1ae3a84 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -4206,6 +4206,7 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) arm_smmu_disable_pasid(master); arm_smmu_remove_master(master); err_free_master: + dev_iommu_priv_set(dev, NULL); kfree(master); return ERR_PTR(ret); } -- 2.54.0.823.g6e5bcc1fc9-goog