On Thu, Sep 10, 2026 at 05:14:05PM -0700, Jonathan Cameron wrote:
quoted
arm_smmu_device_shutdown() only calls arm_smmu_device_disable(), and never
the impl_ops->device_disable() hook. On tegra241-cmdqv, that hook quiesces
every VINTF through tegra241_vintf_hw_deinit(), which issues a CMD_SYNC on
the shared CMDQ while it is still enabled.
arm_smmu_disable_action() already runs this hook before disabling the SMMU,
to cover an unbind or a probe failure, and no devres release ever follows a
reboot or a kexec to run it again. Have arm_smmu_device_shutdown() call it
directly, instead of reimplementing part of what it already does.
Fixes: 9ff145a25c5c ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-5
Assisted-by: LLM
See Documetation/process changes around this. Personally I don't care
either way.
Ah, it looks like they changed that recently. I've been following
the old format now. Since we need a respin, I can fix all the tags.
Nicolin