FROMLIST: amba: bus: Fix race condition during DMA configure at IOMMU… - #1689
Open
Bibek Kumar Patro (bibekpatro) wants to merge 1 commit into
Open
FROMLIST: amba: bus: Fix race condition during DMA configure at IOMMU…#1689Bibek Kumar Patro (bibekpatro) wants to merge 1 commit into
Bibek Kumar Patro (bibekpatro) wants to merge 1 commit into
Conversation
… probe time amba_dma_configure() can be invoked from the IOMMU probe path while a device's driver is still being bound asynchronously by really_probe() on another thread. Call trace: amba_dma_configure __iommu_probe_device probe_iommu_group bus_for_each_dev iommu_device_register arm_smmu_device_probe platform_probe really_probe __driver_probe_device driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_scheduled_works worker_thread kthread ret_from_fork dev->driver is read and converted to a struct amba_driver before it is known whether dev->driver is actually set. If a driver bind completes concurrently with the IOMMU probe path, the driver_managed_dma could end up being dereferenced through an invalid pointer derived from NULL. Update amba_dma_configure() to read dev->driver once and test if it's NULL before using it. This ensures that we don't dereference an invalid amba driver pointer if the device driver is asynchronously bound while configuring the DMA. This is the same TOCTOU race already fixed for the platform bus in commit 95deee3 ("platform: Fix race condition during DMA configure at IOMMU probe time") and for fsl-mc in commit 152f33e ("bus: fsl_mc: Fix driver_managed_dma check"). amba_dma_configure() has the identical pattern, so apply the same fix here. Fixes: bcb81ac ("iommu: Get DT/ACPI parsing into the proper probe path") Link: https://lore.kernel.org/all/20260717-iommu_races-v2-1-d0b7789275af@oss.qualcomm.com/ Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Ketan Kishore <ketan.kishore@oss.qualcomm.com> Reviewed-by: Will McVicker <willmcvicker@google.com>
qcomlnxci
requested review from
a team and
Prakash Gupta (quic-guptap)
and removed request for
a team
August 13, 2026 12:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
… probe time
amba_dma_configure() can be invoked from the IOMMU probe path while a device's driver is still being bound asynchronously by really_probe() on another thread.
Call trace:
amba_dma_configure
__iommu_probe_device
probe_iommu_group
bus_for_each_dev
iommu_device_register
arm_smmu_device_probe
platform_probe
really_probe
__driver_probe_device
driver_probe_device
__device_attach_driver
bus_for_each_drv
__device_attach
device_initial_probe
bus_probe_device
deferred_probe_work_func
process_scheduled_works
worker_thread
kthread
ret_from_fork
dev->driver is read and converted to a struct amba_driver before it is known whether dev->driver is actually set. If a driver bind completes concurrently with the IOMMU probe path, the driver_managed_dma could end up being dereferenced through an invalid pointer derived from NULL.
Update amba_dma_configure() to read dev->driver once and test if it's NULL before using it. This ensures that we don't dereference an invalid amba driver pointer if the device driver is asynchronously bound while configuring the DMA.
This is the same TOCTOU race already fixed for the platform bus in commit 95deee3 ("platform: Fix race condition during DMA configure at IOMMU probe time") and for fsl-mc in commit 152f33e ("bus: fsl_mc: Fix driver_managed_dma check"). amba_dma_configure() has the identical pattern, so apply the same fix here.
Fixes: bcb81ac ("iommu: Get DT/ACPI parsing into the proper probe path")
Link: https://lore.kernel.org/all/20260717-iommu_races-v2-1-d0b7789275af@oss.qualcomm.com/
Cc: stable@vger.kernel.org # 6.1+
Reviewed-by: Will McVicker willmcvicker@google.com
CRs-fixed: 4520015