Re: [PATCH 6.6] iommu/sva: move x86 disable check before allocation

On 8/3/2026 7:40 PM, [email protected] wrote:
> From: Wei Yang <[email protected]>
> 
> Backport of commit 72f98ef9a4be ("iommu: disable SVA when CONFIG_X86 is
> set") placed the IS_ENABLED(CONFIG_X86) early-return in
> iommu_sva_bind_device() after iommu_sva_alloc_pasid() and kzalloc(handle),
> while upstream puts it at the function start.
> 
> On x86 this leaks the kzalloc'd struct iommu_sva (early return skips
> kfree) and a globally allocated PASID (mm->pasid wrongly set, never
> unbound). Move the check before any allocation/side effect.
> 
> Fixes: 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")
> 
> Signed-off-by: Wei Yang <[email protected]>
> ---
> 
> This is a stable-only fix for the linux-6.6.y tree.
> 
> The buggy commit 240cd7f2812c ("iommu: disable SVA when CONFIG_X86 is set")
> is a backport of upstream commit 72f98ef9a4be ("iommu: disable SVA when
> CONFIG_X86 is set") to 6.6. The upstream version places the
> IS_ENABLED(CONFIG_X86) early-return at the start of iommu_sva_bind_device(),
> but the 6.6 backport placed it after iommu_sva_alloc_pasid() and
> kzalloc(handle), causing the leak described above. The upstream/mainline
> code is correct, so this fix is not needed there and only applies to 6.6.
> 
> Please double-check against upstream commit 72f98ef9a4be before applying.
> ---
>   drivers/iommu/iommu-sva.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
> index 611733c02b7c..a340b805b82b 100644
> --- a/drivers/iommu/iommu-sva.c
> +++ b/drivers/iommu/iommu-sva.c
> @@ -62,6 +62,9 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
>   	struct iommu_sva *handle;
>   	int ret;
>   
> +	if (IS_ENABLED(CONFIG_X86))
> +		return ERR_PTR(-EOPNOTSUPP);
> +
>   	/* Allocate mm->pasid if necessary. */
>   	ret = iommu_sva_alloc_pasid(mm, dev);
>   	if (ret)
> @@ -71,9 +74,6 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm
>   	if (!handle)
>   		return ERR_PTR(-ENOMEM);
>   
> -	if (IS_ENABLED(CONFIG_X86))
> -		return ERR_PTR(-EOPNOTSUPP);
> -
>   	mutex_lock(&iommu_sva_lock);
>   	/* Search for an existing domain. */
>   	domain = iommu_get_domain_for_dev_pasid(dev, mm->pasid,

Acked-by: Lu Baolu <[email protected]>