6.18-stable patches

added patches:
	iommu-arm-smmu-qcom-do-not-register-driver-in-probe.patch

diff --git a/queue-6.18/iommu-arm-smmu-qcom-do-not-register-driver-in-probe.patch b/queue-6.18/iommu-arm-smmu-qcom-do-not-register-driver-in-probe.patch
new file mode 100644 (file)
index 0000000..d2f7fcb
--- /dev/null
+++ b/queue-6.18/iommu-arm-smmu-qcom-do-not-register-driver-in-probe.patch
@@ -0,0 +1,150 @@
+From ed1ac3c977dd6b119405fa36dd41f7151bd5b4de Mon Sep 17 00:00:00 2001
+From: Danilo Krummrich <dakr@kernel.org>
+Date: Wed, 21 Jan 2026 15:12:01 +0100
+Subject: iommu/arm-smmu-qcom: do not register driver in probe()
+
+From: Danilo Krummrich <dakr@kernel.org>
+
+commit ed1ac3c977dd6b119405fa36dd41f7151bd5b4de upstream.
+
+Commit 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in
+qcom_smmu_impl_init") intended to also probe the TBU driver when
+CONFIG_ARM_SMMU_QCOM_DEBUG is disabled, but also moved the corresponding
+platform_driver_register() call into qcom_smmu_impl_init() which is
+called from arm_smmu_device_probe().
+
+However, it neither makes sense to register drivers from probe()
+callbacks of other drivers, nor does the driver core allow registering
+drivers with a device lock already being held.
+
+The latter was revealed by commit dc23806a7c47 ("driver core: enforce
+device_lock for driver_match_device()") leading to a deadlock condition
+described in [1].
+
+Additionally, it was noted by Robin that the current approach is
+potentially racy with async probe [2].
+
+Hence, fix this by registering the qcom_smmu_tbu_driver from
+module_init(). Unfortunately, due to the vendoring of the driver, this
+requires an indirection through arm-smmu-impl.c.
+
+Reported-by: Mark Brown <broonie@kernel.org>
+Closes: https://lore.kernel.org/lkml/7ae38e31-ef31-43ad-9106-7c76ea0e8596@sirena.org.uk/
+Link: https://lore.kernel.org/lkml/DFU7CEPUSG9A.1KKGVW4HIPMSH@kernel.org/ [1]
+Link: https://lore.kernel.org/lkml/0c0d3707-9ea5-44f9-88a1-a65c62e3df8d@arm.com/ [2]
+Fixes: dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()")
+Fixes: 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init")
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Tested-by: Bjorn Andersson <andersson@kernel.org>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Acked-by: Konrad Dybcio <konradybcio@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com> #LX2160ARDB
+Tested-by: Wang Jiayue <akaieurus@gmail.com>
+Reviewed-by: Wang Jiayue <akaieurus@gmail.com>
+Tested-by: Mark Brown <broonie@kernel.org>
+Acked-by: Joerg Roedel <joerg.roedel@amd.com>
+Link: https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/arm/arm-smmu/arm-smmu-impl.c |   14 ++++++++++++++
+ drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c |   14 ++++++++++----
+ drivers/iommu/arm/arm-smmu/arm-smmu.c      |   24 +++++++++++++++++++++++-
+ drivers/iommu/arm/arm-smmu/arm-smmu.h      |    5 +++++
+ 4 files changed, 52 insertions(+), 5 deletions(-)
+
+--- a/drivers/iommu/arm/arm-smmu/arm-smmu-impl.c
++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-impl.c
+@@ -228,3 +228,17 @@ struct arm_smmu_device *arm_smmu_impl_in
+ 
+       return smmu;
+ }
++
++int __init arm_smmu_impl_module_init(void)
++{
++      if (IS_ENABLED(CONFIG_ARM_SMMU_QCOM))
++              return qcom_smmu_module_init();
++
++      return 0;
++}
++
++void __exit arm_smmu_impl_module_exit(void)
++{
++      if (IS_ENABLED(CONFIG_ARM_SMMU_QCOM))
++              qcom_smmu_module_exit();
++}
+--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+@@ -773,10 +773,6 @@ struct arm_smmu_device *qcom_smmu_impl_i
+ {
+       const struct device_node *np = smmu->dev->of_node;
+       const struct of_device_id *match;
+-      static u8 tbu_registered;
+-
+-      if (!tbu_registered++)
+-              platform_driver_register(&qcom_smmu_tbu_driver);
+ 
+ #ifdef CONFIG_ACPI
+       if (np == NULL) {
+@@ -801,3 +797,13 @@ struct arm_smmu_device *qcom_smmu_impl_i
+ 
+       return smmu;
+ }
++
++int __init qcom_smmu_module_init(void)
++{
++      return platform_driver_register(&qcom_smmu_tbu_driver);
++}
++
++void __exit qcom_smmu_module_exit(void)
++{
++      platform_driver_unregister(&qcom_smmu_tbu_driver);
++}
+--- a/drivers/iommu/arm/arm-smmu/arm-smmu.c
++++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c
+@@ -2362,7 +2362,29 @@ static struct platform_driver arm_smmu_d
+       .remove = arm_smmu_device_remove,
+       .shutdown = arm_smmu_device_shutdown,
+ };
+-module_platform_driver(arm_smmu_driver);
++
++static int __init arm_smmu_init(void)
++{
++      int ret;
++
++      ret = platform_driver_register(&arm_smmu_driver);
++      if (ret)
++              return ret;
++
++      ret = arm_smmu_impl_module_init();
++      if (ret)
++              platform_driver_unregister(&arm_smmu_driver);
++
++      return ret;
++}
++module_init(arm_smmu_init);
++
++static void __exit arm_smmu_exit(void)
++{
++      arm_smmu_impl_module_exit();
++      platform_driver_unregister(&arm_smmu_driver);
++}
++module_exit(arm_smmu_exit);
+ 
+ MODULE_DESCRIPTION("IOMMU API for ARM architected SMMU implementations");
+ MODULE_AUTHOR("Will Deacon <will@kernel.org>");
+--- a/drivers/iommu/arm/arm-smmu/arm-smmu.h
++++ b/drivers/iommu/arm/arm-smmu/arm-smmu.h
+@@ -540,6 +540,11 @@ struct arm_smmu_device *arm_smmu_impl_in
+ struct arm_smmu_device *nvidia_smmu_impl_init(struct arm_smmu_device *smmu);
+ struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu);
+ 
++int __init arm_smmu_impl_module_init(void);
++void __exit arm_smmu_impl_module_exit(void);
++int __init qcom_smmu_module_init(void);
++void __exit qcom_smmu_module_exit(void);
++
+ void arm_smmu_write_context_bank(struct arm_smmu_device *smmu, int idx);
+ int arm_mmu500_reset(struct arm_smmu_device *smmu);
+ 

diff --git a/queue-6.18/series b/queue-6.18/series
index dd5562eda478111565f69bdb516bb24604244418..5e4ba0a4a0a1dd601fca1b6d961549c3e83f3424 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -37,3 +37,4 @@ f2fs-fix-to-avoid-uaf-in-f2fs_write_end_io.patch
 f2fs-support-non-4kb-block-size-without-packed_ssa-feature.patch
 f2fs-fix-to-avoid-mapping-wrong-physical-block-for-swapfile.patch
 f2fs-optimize-f2fs_overwrite_io-for-f2fs_iomap_begin.patch
+iommu-arm-smmu-qcom-do-not-register-driver-in-probe.patch