[PATCH v2] amba: bus: Fix race condition during DMA configure at IOMMU probe time

[Ketan Kishore]

amba_dma_configure() can be invoked from the IOMMU probe path while a
device's driver is still being bound asynchronously by really_probe()
on another thread.
Call trace:
  amba_dma_configure
  __iommu_probe_device
  probe_iommu_group
  bus_for_each_dev
  iommu_device_register
  arm_smmu_device_probe
  platform_probe
  really_probe
  __driver_probe_device
  driver_probe_device
  __device_attach_driver
  bus_for_each_drv
  __device_attach
  device_initial_probe
  bus_probe_device
  deferred_probe_work_func
  process_scheduled_works
  worker_thread
  kthread
  ret_from_fork

dev->driver is read and converted to a struct amba_driver before it
is known whether dev->driver is actually set. If a driver bind
completes concurrently with the IOMMU probe path, the
driver_managed_dma could end up being dereferenced through an
invalid pointer derived from NULL.

Update amba_dma_configure() to read dev->driver once and test if it's
NULL before using it. This ensures that we don't dereference an
invalid amba driver pointer if the device driver is asynchronously
bound while configuring the DMA.

This is the same TOCTOU race already fixed for the platform bus in
commit 95deee37a123 ("platform: Fix race condition during DMA
configure at IOMMU probe time") and for fsl-mc in commit 152f33ee30ee
("bus: fsl_mc: Fix driver_managed_dma check"). amba_dma_configure()
has the identical pattern, so apply the same fix here.

Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path")
Cc: stable@xxxxxxxxxxxxxxx # 6.1+
Signed-off-by: Ketan Kishore <ketan.kishore@xxxxxxxxxxxxxxxx>
---
Changes in v2:
- Change the patch's commit description to only CC stable for 6.1+ stable kernel branches
  and not for all stable releases prior to 6.1 .
- Link to v1: https://patch.msgid.link/20260715-iommu_races-v1-1-3c4ed13b18a3@xxxxxxxxxxxxxxxx

To: Russell King <linux@xxxxxxxxxxxxxxx>
To: Robin Murphy <robin.murphy@xxxxxxx>
To: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
To: Lorenzo Pieralisi <lpieralisi@xxxxxxxxxx>
To: Joerg Roedel <jroedel@xxxxxxx>
To: "Rob Herring (Arm)" <robh@xxxxxxxxxx>
Cc: kernel@xxxxxxxxxxxxxxxx
Cc: Jason Gunthorpe <jgg@xxxxxxxx>
Cc: linux-kernel@xxxxxxxxxxxxxxx
---
 drivers/amba/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index d721d64a9858..0cdda7e07af7 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -324,7 +324,7 @@ static void amba_shutdown(struct device *dev)
 
 static int amba_dma_configure(struct device *dev)
 {
-	struct amba_driver *drv = to_amba_driver(dev->driver);
+	const struct device_driver *drv = READ_ONCE(dev->driver);
 	enum dev_dma_attr attr;
 	int ret = 0;
 
@@ -336,7 +336,7 @@ static int amba_dma_configure(struct device *dev)
 	}
 
 	/* @drv may not be valid when we're called from the IOMMU layer */
-	if (!ret && dev->driver && !drv->driver_managed_dma) {
+	if (!ret && drv && !to_amba_driver(drv)->driver_managed_dma) {
 		ret = iommu_device_use_default_domain(dev);
 		if (ret)
 			arch_teardown_dma_ops(dev);

---
base-commit: 49362394dad7df66c274c867a271394c10ca2bb8
change-id: 20260714-iommu_races-a4363c9af982

Best regards,
--  
Ketan Kishore <ketan.kishore@xxxxxxxxxxxxxxxx>