[PATCH v3 0/2] iommu/arm-smmu-v3: Fix Tegra241 CMDQV CMD_SYNC use-after-free

[Shameer Kolothum]

Hi,

Changes from v2:
 https://lore.kernel.org/linux-iommu/20260611084205.686559-1-skolothumtho@nvidia.com/

 -Addressed feedback and picked up R-by tags(Thanks!).
 -Use explicit type casts in devm action callbacks(patch #1)
 -Add Cc: stable to patch #1 as it is a pre requisite for patch #2.

Please take a look and let me know.

Thanks,
Shameer

>From v2:

The arm-smmu-v3 probe teardown mixes devm and manual cleanup, so resources
unwind in the wrong order. The IOPF queue is freed before the event-queue
IRQ whose handler uses it. On Tegra241 this is worse: devres frees
smmu->cmdq.q.base before arm_smmu_impl_remove() runs, and the CMDQV
teardown then issues a CMD_SYNC on the freed queue, a use-after-free.

Patch 1 moves the remaining manual teardown (IOPF queue, vmid_map, device
disable) onto devm so the unwind order is correct. Patch 2 adds a
device_disable() impl op and uses it to quiesce the Tegra241 VINTFs
while the CMDQ is still up, fixing the UAF.

Shameer Kolothum (2):
  iommu/arm-smmu-v3: Manage teardown with devm
  iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h   |  1 +
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c   | 58 ++++++++++++++-----
 .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c    | 15 ++++-
 3 files changed, 56 insertions(+), 18 deletions(-)

-- 
2.43.0