Re: [PATCH v1 2/4] iommu/arm-smmu-v3: Fix fwnode lookup lifetime handling

[Jason Gunthorpe]

On Wed, Jul 15, 2026 at 04:37:32PM -0300, Jason Gunthorpe wrote:
> On Tue, Jul 14, 2026 at 02:09:28PM +0800, weimin xiong wrote:
> > bus_find_device_by_fwnode() returns a device with its reference count
> > incremented. arm_smmu_get_by_fwnode() drops that reference before
> > reading the driver data, which leaves the returned pointer derived from
> > a device after its reference has been released.
> > 
> > Read the driver data before put_device() and return NULL directly when
> > the lookup fails.
> > 
> > Signed-off-by: weimin xiong <xiongwm2026@xxxxxxx>
> > ---
> >  drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 8 +++++++-
> >  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> Reviewed-by: Jason Gunthorpe <jgg@xxxxxxxxxx>

Actually I got confused what this was..

No, this is nonsense, if the devdata is racily being freed then so is
the smmu pointer.

The whole design does not support hot unplug of the iommu and the
purpose of the put_device is to pair with the
bus_find_device_by_fwnode() not to control any memory lifetime.

Same comment for other similar patches in this series

Jason