[PATCH 5.10/5.15] iommu/amd: Fix clone_alias() to use the original device's devid

[Mikhail Dmitrichenko]

From: Vasant Hegde <vasant.hegde@xxxxxxx>

commit faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 upstream.

Currently clone_alias() assumes first argument (pdev) is always the
original device pointer. This function is called by
pci_for_each_dma_alias() which based on topology decides to send
original or alias device details in first argument.

This meant that the source devid used to look up and copy the DTE
may be incorrect, leading to wrong or stale DTE entries being
propagated to alias device.

Fix this by passing the original pdev as the opaque data argument to
both the direct clone_alias() call and pci_for_each_dma_alias(). Inside
clone_alias(), retrieve the original device from data and compute devid
from it.

Fixes: 3332364e4ebc ("iommu/amd: Support multiple PCI DMA aliases in device table")
Signed-off-by: Vasant Hegde <vasant.hegde@xxxxxxx>
Signed-off-by: Joerg Roedel <joerg.roedel@xxxxxxx>
[mdmitrichenko: Replace iommu->pci_seg->alias_table with the global
 amd_iommu_alias_table used by 5.10/5.15.]
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@xxxxxxxxxxxxx>
---
Backport fix for CVE-2026-53053.

 drivers/iommu/amd/iommu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 334303b1d27bb..d8af774124a98 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -216,8 +216,9 @@ static struct iommu_dev_data *search_dev_data(u16 devid)
 	return NULL;
 }
 
-static int clone_alias(struct pci_dev *pdev, u16 alias, void *data)
+static int clone_alias(struct pci_dev *pdev_origin, u16 alias, void *data)
 {
+	struct pci_dev *pdev = data;
 	u16 devid = pci_dev_id(pdev);
 
 	if (devid == alias)
@@ -242,9 +243,9 @@ static void clone_aliases(struct pci_dev *pdev)
 	 * part of the PCI DMA aliases if it's bus differs
 	 * from the original device.
 	 */
-	clone_alias(pdev, amd_iommu_alias_table[pci_dev_id(pdev)], NULL);
+	clone_alias(pdev, amd_iommu_alias_table[pci_dev_id(pdev)], pdev);
 
-	pci_for_each_dma_alias(pdev, clone_alias, NULL);
+	pci_for_each_dma_alias(pdev, clone_alias, pdev);
 }
 
 static struct pci_dev *setup_aliases(struct device *dev)
-- 
2.43.0