Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] arm-iommu: missing owns_domain check in arm_iommu_attach_device causes kref warning --
commit 9a5832f0c5c50cf332fad22584273f026af693a5 Author: Mikko Perttunen <[email protected]> ARM: dma-mapping: Implement and expose DMA setup functions This commit allows the IOMMU core to allocate DMA domains and get the cookie from the ARM DMA code. It implements ARM versions of iommu_get_dma_cookie and iommu_put_dma_cookie. > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index 4284950a92469..f2d3e8ec34872 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c [ ... ] > @@ -1660,6 +1742,14 @@ void arm_iommu_detach_device(struct device *dev) > return; > } > > + /* > + * This pairs with arm_iommu_attach_device() on a driver-owned mapping. > + * A mapping which is merely the cookie of a core-owned default domain > + * must not be torn down from here. > + */ > + if (WARN_ON(!mapping->owns_domain)) > + return; > + [Severity: High] Should __arm_iommu_attach_device() also have a similar check for !mapping->owns_domain? Mappings created by the IOMMU core via iommu_get_dma_cookie() are zero-initialized and bypass kref_init(), relying instead on the owns_domain flag being false to prevent refcount operations. If a legacy driver saves a device's original core-owned mapping during initialization and later attempts to restore it by calling arm_iommu_attach_device(), __arm_iommu_attach_device() will execute: arch/arm/mm/dma-mapping.c:__arm_iommu_attach_device() { ... err = iommu_attach_device(mapping->domain, dev); if (err) return err; kref_get(&mapping->kref); ... } Calling kref_get() on a zero-initialized kref would trigger a refcount warning traceback. Does __arm_iommu_attach_device() need a WARN_ON(!mapping->owns_domain) check to prevent driver interactions with core-owned mappings? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
