[PATCH v1 0/2] iommu/virtio: Fix probe error handling

[PATCH v1 0/2] iommu/virtio: Fix probe error handling

[weimin xiong]

From: Xiong Weimin <xiongweimin@kylinos.cn>

Hi,

This small series fixes two probe-time error handling issues in the
virtio-iommu driver.

The first patch avoids dereferencing a device after dropping the
reference returned by bus_find_device(). The second patch propagates
failures from iommu_device_register() and unwinds the resources that
were set up earlier in probe.

Xiong Weimin (2):
  iommu/virtio: Avoid use-after-put in viommu_get_by_fwnode
  iommu/virtio: Handle iommu_device_register() failures

 drivers/iommu/virtio-iommu.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

-- 
2.43.0

[PATCH v1 1/2] iommu/virtio: Avoid use-after-put in viommu_get_by_fwnode

[weimin xiong]

From: Xiong Weimin <xiongweimin@kylinos.cn>

bus_find_device() returns a device reference that must be released with
put_device(). viommu_get_by_fwnode() currently drops that reference
before dereferencing the device to fetch the virtio-IOMMU private data.

Fetch the private data while the reference is still held, then release
the device reference before returning.

Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
---
 drivers/iommu/virtio-iommu.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 587fc1319..342785c76 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -1009,12 +1009,16 @@ static int viommu_match_node(struct device *dev, const void *data)
 
 static struct viommu_dev *viommu_get_by_fwnode(struct fwnode_handle *fwnode)
 {
+	struct viommu_dev *viommu = NULL;
 	struct device *dev = bus_find_device(virtio_bus_type, NULL, fwnode,
 					     viommu_match_node);
 
-	put_device(dev);
+	if (dev) {
+		viommu = dev_to_virtio(dev)->priv;
+		put_device(dev);
+	}
 
-	return dev ? dev_to_virtio(dev)->priv : NULL;
+	return viommu;
 }
 
 static struct iommu_device *viommu_probe_device(struct device *dev)
-- 
2.43.0

[PATCH v1 2/2] iommu/virtio: Handle iommu_device_register() failures

[weimin xiong]

From: Xiong Weimin <xiongweimin@kylinos.cn>

iommu_device_register() returns an error when the IOMMU core fails to
register the hardware instance or probe the buses. viommu_probe()
currently ignores that error and continues as if the device was
registered successfully.

Propagate the failure and unwind the sysfs entry and virtqueues that
were set up earlier. Clear the driver data on the error path as well,
since it is set before registration so bus probing can find the
virtio-IOMMU instance.

Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
---
 drivers/iommu/virtio-iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
index 342785c76..9118377d7 100644
--- a/drivers/iommu/virtio-iommu.c
+++ b/drivers/iommu/virtio-iommu.c
@@ -1240,7 +1240,9 @@ static int viommu_probe(struct virtio_device *vdev)
 
 	vdev->priv = viommu;
 
-	iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
+	ret = iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
+	if (ret)
+		goto err_remove_sysfs;
 
 	dev_info(dev, "input address: %u bits\n",
 		 order_base_2(viommu->geometry.aperture_end));
@@ -1248,8 +1250,11 @@ static int viommu_probe(struct virtio_device *vdev)
 
 	return 0;
 
+err_remove_sysfs:
+	iommu_device_sysfs_remove(&viommu->iommu);
 err_free_vqs:
 	vdev->config->del_vqs(vdev);
+	vdev->priv = NULL;
 
 	return ret;
 }
-- 
2.43.0

Re: [PATCH v1 2/2] iommu/virtio: Handle iommu_device_register() failures

[Will Deacon]

On Tue, Jul 14, 2026 at 10:49:49AM +0800, weimin xiong wrote:
> From: Xiong Weimin <xiongweimin@kylinos.cn>
> 
> iommu_device_register() returns an error when the IOMMU core fails to
> register the hardware instance or probe the buses. viommu_probe()
> currently ignores that error and continues as if the device was
> registered successfully.
> 
> Propagate the failure and unwind the sysfs entry and virtqueues that
> were set up earlier. Clear the driver data on the error path as well,
> since it is set before registration so bus probing can find the
> virtio-IOMMU instance.
> 
> Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
> ---
>  drivers/iommu/virtio-iommu.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
> index 342785c76..9118377d7 100644
> --- a/drivers/iommu/virtio-iommu.c
> +++ b/drivers/iommu/virtio-iommu.c
> @@ -1240,7 +1240,9 @@ static int viommu_probe(struct virtio_device *vdev)
>  
>  	vdev->priv = viommu;
>  
> -	iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
> +	ret = iommu_device_register(&viommu->iommu, &viommu_ops, parent_dev);
> +	if (ret)
> +		goto err_remove_sysfs;

Given that the first patch shouldn't be needed (per Robin's comments at
[1]) and this is augmented an error path that we shouldn't be hitting in
practice, I don't think we need to treat this as a fix. You can probably
just lump it in with your virtio-iommu hardening series.

Will