[PATCH 2/7] iommu/arm-smmu-v3: Prevent rbtree corruption from duplicate streams

[Mostafa Saleh]

On Fri, Aug 28, 2026 at 08:51:18AM -0700, Nicolin Chen wrote:
> On Fri, Aug 28, 2026 at 12:53:37PM +0000, Mostafa Saleh wrote:
> > In handling PCI devices with duplicate IDs, arm_smmu_insert_master()
> > will continue the loop skipping the duplicate sids insertion in the
> > rbtree.
> > However, in the error path of arm_smmu_insert_master() and in
> > arm_smmu_remove_master(), the code loops over all fwspec->num_ids and
> > calls rb_erase() unconditionally.
> > 
> > For the duplicate streams, the node is zero allocated including the
> > parent pointer "__rb_parent_color". That means rb_erase() will think
> > that this node is root and it will corrupt the tree which includes
> > other masters not being removed.
> > 
> > Fix this by initializing those nodes with RB_CLEAR_NODE() and check
> > if they are empty before erasing.
> > 
> > Fixes: cdf315f907d4 ("iommu/arm-smmu-v3: Maintain a SID->device structure")
> > Reported-by: Sashiko <>
> > Signed-off-by: Mostafa Saleh <smostafa at google.com>
> 
> I submitted a similar patch a while ago :)
> https://lore.kernel.org/linux-iommu/9136477b9c737a50cecc38f2ee6704a01510169a.1783044582.git.nicolinc@nvidia.com/

Oh, I missed that, I haven't looked at this series. I beleive this
bug exists in the current tree so it is better to send separately.

Anyway, I ok dropping this patch if you want to re-send yours.

Thanks,
Mostafa

> 
> And I think the fix tag, as mine posted, should be:
> Fixes: b00d24997a11 ("iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids")
> 
> Before that commit, a duplicated SID gets -EINVAL and errors out.
> 
> Thanks
> Nicolin