Re: [PATCH v2 00/11] iommu/tegra241-cmdqv: Fix error-interrupt races and VINTF lifecycle bugs

[Will Deacon]

On Tue, 14 Jul 2026 13:54:57 -0700, Nicolin Chen wrote:
> These fix a cluster of bugs reported by Sashiko during patch reviews. The
> patches are ordered roughly most-critical-first, so some later ones fix
> smaller pre-existing issues in the same functions that earlier patches
> touch.
> 
> Issues fixed:
>   - the error ISR racing VINTF (de)init and reading a NULL, freed, or not
>     yet fully initialized slot
>   - the probe fallback dereferencing an smmu freed by devm_krealloc()
>   - a guest vSID programmed without validating its width or the device's
>     Stream ID count
>   - VINTF0 leaked on an init-failure path
>   - error-map index/bounds handling and a VCMDQ base above the 48-bit limit
>   - the error ISR flooding the kernel log under repeated guest errors
> 
> [...]

Applied (apart from patch 10) to iommu (arm/smmu/updates), thanks!

[01/11] iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
        https://git.kernel.org/iommu/c/cbc41aacd49e
[02/11] iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
        https://git.kernel.org/iommu/c/a491be376abd
[03/11] iommu/tegra241-cmdqv: Harden error-map index handling in the error ISR
        https://git.kernel.org/iommu/c/a2ee315db426
[04/11] iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
        https://git.kernel.org/iommu/c/5acd67ceb38d
[05/11] iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
        https://git.kernel.org/iommu/c/d4d05f55e9da
[06/11] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
        https://git.kernel.org/iommu/c/61f0d437988e
[07/11] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
        https://git.kernel.org/iommu/c/4379610c79bd
[08/11] iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
        https://git.kernel.org/iommu/c/fb292bfc9be9
[09/11] iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
        https://git.kernel.org/iommu/c/f40f31444773
[11/11] iommu/tegra241-cmdqv: Rate-limit the error ISR's log message
        https://git.kernel.org/iommu/c/a86c36163c97

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev