linux.git/drivers/xen, branch master Linux kernel source tree xenbus: reject unterminated directory replies 2026-07-01T08:01:14+00:00 Yousef Alhouseen alhouseenyousef@gmail.com 2026-06-26T22:37:38+00:00 cbbef43bdc083892a2d4787245c249502c215bb8 split_strings() walks each directory entry with strlen(). Although the transport adds a terminator after the reply buffer, a malformed reply without a final NUL inside its advertised length would let that walk cross the protocol payload boundary. Reject such replies before counting the strings. Report the protocol violation once and return -EIO to the caller. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com> 
split_strings() walks each directory entry with strlen(). Although the
transport adds a terminator after the reply buffer, a malformed reply
without a final NUL inside its advertised length would let that walk
cross the protocol payload boundary.

Reject such replies before counting the strings. Report the protocol
violation once and return -EIO to the caller.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com>
xen/gntalloc: validate grant count before allocation 2026-07-01T07:58:24+00:00 Yousef Alhouseen alhouseenyousef@gmail.com 2026-06-26T22:38:05+00:00 2299822f3f466b5dcad2377bf63986199f881a6b gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260626223805.43781-3-alhouseenyousef@gmail.com> 
gntalloc_ioctl_alloc() allocates the grant-id array before checking
whether the requested count fits within the global grant limit. Counts
above that limit cannot succeed, so reject them before the
user-controlled allocation reaches kcalloc().

Use a subtraction-based check while holding gref_mutex so adding the
requested count cannot wrap. Also cast the count before advancing the
per-file index so the page-size multiplication is performed in 64-bit
arithmetic.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223805.43781-3-alhouseenyousef@gmail.com>
xen/gntalloc: make grant counters unsigned 2026-07-01T07:58:24+00:00 Yousef Alhouseen alhouseenyousef@gmail.com 2026-06-26T22:38:04+00:00 51d111301a3ad8e5655687cb6462182e5804fa02 The module limit and current allocation count cannot validly be negative. Give both variables unsigned types so their representation matches the u32 grant count supplied through the ioctl and negative module parameter values are rejected by parameter parsing. This also prepares the limit check for overflow-safe unsigned arithmetic. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260626223805.43781-2-alhouseenyousef@gmail.com> 
The module limit and current allocation count cannot validly be
negative. Give both variables unsigned types so their representation
matches the u32 grant count supplied through the ioctl and negative
module parameter values are rejected by parameter parsing.

This also prepares the limit check for overflow-safe unsigned
arithmetic.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223805.43781-2-alhouseenyousef@gmail.com>
xen/front-pgdir-shbuf: free grant reference head on errors 2026-07-01T07:51:41+00:00 Yousef Alhouseen alhouseenyousef@gmail.com 2026-06-29T16:05:17+00:00 678d59219ce0ae883f04c96936222c6168ef1164 grant_references() allocates a private grant-reference head before claiming references for the page directory and, for guest-owned buffers, the data pages. The success path frees the remaining head, but claim failures and grant_refs_for_buffer() errors return immediately. Unwind through a common exit path so the private grant-reference head is released even when granting fails part-way through setup. The caller still tears down any references already stored in buf->grefs. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260629160517.29340-1-alhouseenyousef@gmail.com> 
grant_references() allocates a private grant-reference head before
claiming references for the page directory and, for guest-owned buffers,
the data pages. The success path frees the remaining head, but claim
failures and grant_refs_for_buffer() errors return immediately.

Unwind through a common exit path so the private grant-reference head is
released even when granting fails part-way through setup. The caller
still tears down any references already stored in buf->grefs.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260629160517.29340-1-alhouseenyousef@gmail.com>
xen/gntdev: fix error handling in ioctl 2026-07-01T07:51:09+00:00 Wentao Liang vulab@iscas.ac.cn 2026-06-22T11:25:41+00:00 45ca1afe2fd14c04e37227e79d3f8455831d8408 When gntdev_ioctl_map_grant_ref() fails to copy the operation result back to userspace after successfully adding the mapping to the list, the error path returns -EFAULT without releasing the reference acquired by gntdev_alloc_map(). The mapping remains in priv->maps with a refcount of 1, causing a memory leak and a dangling list entry. Additionally, gntdev_add_map() may modify map->index to avoid overlap with existing mappings. Therefore, the index returned to userspace must be obtained after gntdev_add_map() completes. Fix this by holding the mutex across gntdev_add_map(), retrieving the correct index, and copy_to_user(). If copy_to_user() fails, remove the mapping from the list and release the reference while still holding the lock. Cc: stable@vger.kernel.org Fix these issues by properly handling all error cases. Fixes: 1401c00e59ea ("xen/gntdev: convert priv->lock to a mutex") Fixes: 68b025c813c2 ("xen-gntdev: Add reference counting to maps") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260622112541.38194-1-vulab@iscas.ac.cn> 
When gntdev_ioctl_map_grant_ref() fails to copy the operation result
back to userspace after successfully adding the mapping to the list,
the error path returns -EFAULT without releasing the reference
acquired by gntdev_alloc_map(). The mapping remains in priv->maps
with a refcount of 1, causing a memory leak and a dangling list
entry.

Additionally, gntdev_add_map() may modify map->index to avoid overlap
with existing mappings. Therefore, the index returned to userspace
must be obtained after gntdev_add_map() completes.

Fix this by holding the mutex across gntdev_add_map(), retrieving
the correct index, and copy_to_user(). If copy_to_user() fails,
remove the mapping from the list and release the reference while
still holding the lock.

Cc: stable@vger.kernel.org

Fix these issues by properly handling all error cases.

Fixes: 1401c00e59ea ("xen/gntdev: convert priv->lock to a mutex")
Fixes: 68b025c813c2 ("xen-gntdev: Add reference counting to maps")

Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260622112541.38194-1-vulab@iscas.ac.cn>
xen/pvcalls: bound backend response req_id before indexing rsp[] 2026-07-01T07:31:02+00:00 Michael Bommarito michael.bommarito@gmail.com 2026-06-17T01:41:49+00:00 d33846c8dcc06b83b7acdeac1e8bfbb5c0c26cb2 pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds write past the bedata allocation. req_id was also declared int while the wire field rsp->req_id is u32, so a range check on the signed value alone is insufficient: a backend req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single bound covers both ends. A backend that sends an out-of-range req_id has violated the wire protocol, so rather than silently dropping the response, log once and stop trusting the backend: set bedata->disabled. The event handler then ignores further responses, and the request paths that wait for a response return -EIO instead of blocking forever. This mirrors the fatal-error handling xen-netback uses (xenvif_fatal_tx_err()). The pvcalls frontend currently trusts its backend, so this is not a classic-Xen security issue, but it matters for hardening PV frontends against malicious backends (confidential and disaggregated deployments). Fixes: 2195046bfd69 ("xen/pvcalls: implement socket command and handle events") Suggested-by: Juergen Gross <jgross@suse.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260617014149.2647404-1-michael.bommarito@gmail.com> 
pvcalls_front_event_handler() takes req_id directly from the
backend-supplied ring response and uses it to index the fixed-size
bedata->rsp[] array for a memcpy() and a store, with no range check. A
malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING
and drive an out-of-bounds write past the bedata allocation.

req_id was also declared int while the wire field rsp->req_id is u32, so
a range check on the signed value alone is insufficient: a backend
req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING
test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single
bound covers both ends.

A backend that sends an out-of-range req_id has violated the wire
protocol, so rather than silently dropping the response, log once and
stop trusting the backend: set bedata->disabled. The event handler then
ignores further responses, and the request paths that wait for a
response return -EIO instead of blocking forever. This mirrors the
fatal-error handling xen-netback uses (xenvif_fatal_tx_err()).

The pvcalls frontend currently trusts its backend, so this is not a
classic-Xen security issue, but it matters for hardening PV frontends
against malicious backends (confidential and disaggregated deployments).

Fixes: 2195046bfd69 ("xen/pvcalls: implement socket command and handle events")
Suggested-by: Juergen Gross <jgross@suse.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260617014149.2647404-1-michael.bommarito@gmail.com>
Merge tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux 2026-06-17T18:54:57+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-17T18:54:57+00:00 09fb6892f34abdb6d9b50ae7337b7b7b56dc82d6 Pull devicetree updates from Rob Herring: "DT core: - Add support for handling multiple cells in "iommu-map" entries - Support only 1 entry in /reserved-memory "reg" entries. Support for more than 1 entry has been broken - Fix a UAF on alloc_reserved_mem_array() failure - Make "ibm,phandle" handling logic specific to PPC - Use memcpy() instead of strcpy() for known length strings - Ensure __of_find_n_match_cpu_property() handles malformed "reg" entries - Add various checks that expected strings are strings before accessing them - Drop redundant memset() when unflattening DT DT bindings: - Add a DTS style checker. Currently hooked up to dt_binding_check to check examples - Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar bindings to DT schema - Add Apple System Management Controller hwmon, Qualcomm Hamoa Embedded Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323, Samsung SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder, Samsung S2M series PMIC extcon, and MT6365 PMIC AuxADC schemas - Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc, qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys - Consolidate "sram" property definitions - Fix constraints on "nvmem" properties which only contain phandles and no arg cells - Another pass of fixing "phandle-array" constraints - Add Gira vendor prefix" * tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits) dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible string dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema dt-bindings: vendor-prefixes: add Gira dt-bindings: embedded-controller: Add Qualcomm reference device EC description dt-bindings: pwm: add IPQ6018 binding dt-bindings: hwmon: Add Apple System Management Controller hwmon schema docs: dt: writing-schema: Clarify what is required in a schema of: Respect #{iommu,msi}-cells in maps of: Factor arguments passed to of_map_id() into a struct of: Add convenience wrappers for of_map_id() of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry of: reserved_mem: handle NULL name in of_reserved_mem_lookup() dt-bindings: cache: l2c2x0: Add missing power-domains dt-bindings: interrupt-controller: renesas,r9a09g077-icu: Fix reg size in example dt-bindings: nvmem: consumer: Make 'nvmem' an array of one-item entries drivers/of/overlay: Use memcpy() to copy known length strings dt-bindings: add self-test fixtures for style checker dt-bindings: wire style checker into dt_binding_check scripts/jobserver-exec: propagate child exit status dt-bindings: add DTS style checker ... 
Pull devicetree updates from Rob Herring:
 "DT core:

   - Add support for handling multiple cells in "iommu-map" entries

   - Support only 1 entry in /reserved-memory "reg" entries. Support for
     more than 1 entry has been broken

   - Fix a UAF on alloc_reserved_mem_array() failure

   - Make "ibm,phandle" handling logic specific to PPC

   - Use memcpy() instead of strcpy() for known length strings

   - Ensure __of_find_n_match_cpu_property() handles malformed "reg"
     entries

   - Add various checks that expected strings are strings before
     accessing them

   - Drop redundant memset() when unflattening DT

  DT bindings:

   - Add a DTS style checker. Currently hooked up to dt_binding_check to
     check examples

   - Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar
     bindings to DT schema

   - Add Apple System Management Controller hwmon, Qualcomm Hamoa
     Embedded Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323,
     Samsung SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder,
     Samsung S2M series PMIC extcon, and MT6365 PMIC AuxADC schemas

   - Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc,
     qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys

   - Consolidate "sram" property definitions

   - Fix constraints on "nvmem" properties which only contain phandles
     and no arg cells

   - Another pass of fixing "phandle-array" constraints

   - Add Gira vendor prefix"

* tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits)
  dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible string
  dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema
  dt-bindings: vendor-prefixes: add Gira
  dt-bindings: embedded-controller: Add Qualcomm reference device EC description
  dt-bindings: pwm: add IPQ6018 binding
  dt-bindings: hwmon: Add Apple System Management Controller hwmon schema
  docs: dt: writing-schema: Clarify what is required in a schema
  of: Respect #{iommu,msi}-cells in maps
  of: Factor arguments passed to of_map_id() into a struct
  of: Add convenience wrappers for of_map_id()
  of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry
  of: reserved_mem: handle NULL name in of_reserved_mem_lookup()
  dt-bindings: cache: l2c2x0: Add missing power-domains
  dt-bindings: interrupt-controller: renesas,r9a09g077-icu: Fix reg size in example
  dt-bindings: nvmem: consumer: Make 'nvmem' an array of one-item entries
  drivers/of/overlay: Use memcpy() to copy known length strings
  dt-bindings: add self-test fixtures for style checker
  dt-bindings: wire style checker into dt_binding_check
  scripts/jobserver-exec: propagate child exit status
  dt-bindings: add DTS style checker
  ...
Merge tag 'x86-cpu-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip 2026-06-15T09:55:17+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-15T09:55:17+00:00 ff5ccdb8d5bd242f1064c6f7996603e47e28d095 Pull x86 cpuid updates from Ingo Molnar: - CPUID API updates (Ahmed S. Darwish): - Introduce a centralized CPUID parser - Introduce a centralized CPUID data model - Introduce <asm/cpuid/leaf_types.h> - Rename cpuid_leaf()/cpuid_subleaf() APIs - treewide: Explicitly include the x86 CPUID headers - Update to x86-cpuid-db v3.1 (Maciej Wieczor-Retman) - Continued removal of pre-i586 support and related simplifications (Ingo Molnar) - Add Intel CPU model number for rugged Panther Lake (Tony Luck) - Misc fixes, updates and cleanups by Arnd Bergmann, Chao Gao, Lukas Bulwahn, Sohil Mehta, Maciej Wieczor-Retman. * tag 'x86-cpu-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (25 commits) x86/cpu: Make CONFIG_X86_CX8 unconditional x86/cpu: Remove unused !CONFIG_X86_TSC code x86/cpuid: Update bitfields to x86-cpuid-db v3.1 tools/x86/kcpuid: Update bitfields to x86-cpuid-db v3.1 x86/cpu: Make CONFIG_X86_TSC unconditional MAINTAINERS: Drop obsolete FPU EMULATOR section x86/cpu: Fix a F00F bug warning and clean up surrounding code x86/cpu: Add Intel CPU model number for rugged Panther Lake x86/cpuid: Introduce a centralized CPUID parser x86/cpu: Introduce a centralized CPUID data model x86/cpuid: Introduce <asm/cpuid/leaf_types.h> x86/cpuid: Rename cpuid_leaf()/cpuid_subleaf() APIs x86/cpu: Do not include the CPUID API header in asm/processor.h Documentation: core-api/cpu_hotplug: Remove stale cpu0_hotplug docs x86/cpu, cpufreq: Remove AMD ELAN support x86/fpu: Remove the math-emu/ FPU emulation library x86/fpu: Remove the 'no387' boot option x86/fpu: Remove MATH_EMULATION and related glue code treewide: Explicitly include the x86 CPUID headers x86/cpu: Remove the CONFIG_X86_INVD_BUG quirk ... 
Pull x86 cpuid updates from Ingo Molnar:

 - CPUID API updates (Ahmed S. Darwish):
    - Introduce a centralized CPUID parser
    - Introduce a centralized CPUID data model
    - Introduce <asm/cpuid/leaf_types.h>
    - Rename cpuid_leaf()/cpuid_subleaf() APIs
    - treewide: Explicitly include the x86 CPUID headers

 - Update to x86-cpuid-db v3.1 (Maciej Wieczor-Retman)

 - Continued removal of pre-i586 support and related simplifications
   (Ingo Molnar)

 - Add Intel CPU model number for rugged Panther Lake (Tony Luck)

 - Misc fixes, updates and cleanups by Arnd Bergmann, Chao Gao, Lukas
   Bulwahn, Sohil Mehta, Maciej Wieczor-Retman.

* tag 'x86-cpu-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (25 commits)
  x86/cpu: Make CONFIG_X86_CX8 unconditional
  x86/cpu: Remove unused !CONFIG_X86_TSC code
  x86/cpuid: Update bitfields to x86-cpuid-db v3.1
  tools/x86/kcpuid: Update bitfields to x86-cpuid-db v3.1
  x86/cpu: Make CONFIG_X86_TSC unconditional
  MAINTAINERS: Drop obsolete FPU EMULATOR section
  x86/cpu: Fix a F00F bug warning and clean up surrounding code
  x86/cpu: Add Intel CPU model number for rugged Panther Lake
  x86/cpuid: Introduce a centralized CPUID parser
  x86/cpu: Introduce a centralized CPUID data model
  x86/cpuid: Introduce <asm/cpuid/leaf_types.h>
  x86/cpuid: Rename cpuid_leaf()/cpuid_subleaf() APIs
  x86/cpu: Do not include the CPUID API header in asm/processor.h
  Documentation: core-api/cpu_hotplug: Remove stale cpu0_hotplug docs
  x86/cpu, cpufreq: Remove AMD ELAN support
  x86/fpu: Remove the math-emu/ FPU emulation library
  x86/fpu: Remove the 'no387' boot option
  x86/fpu: Remove MATH_EMULATION and related glue code
  treewide: Explicitly include the x86 CPUID headers
  x86/cpu: Remove the CONFIG_X86_INVD_BUG quirk
  ...
of: Factor arguments passed to of_map_id() into a struct 2026-06-12T15:25:39+00:00 Charan Teja Kalla charan.kalla@oss.qualcomm.com 2026-06-03T07:13:13+00:00 f71f07bee9b56b94f7828cf3082ea19ec590de36 Change of_map_id() to take a pointer to struct of_phandle_args instead of passing target device node and translated IDs separately. Update all callers accordingly. Add an explicit filter_np parameter to of_map_id() and of_map_msi_id() to separate the filter input from the output. Previously, the target parameter served dual purpose: as an input filter (if non-NULL, only match entries targeting that node) and as an output (receiving the matched node with a reference held). Now filter_np is the explicit input filter and arg->np is the pure output. Previously, of_map_id() would call of_node_put() on the matched node when a filter was provided, making reference ownership inconsistent. Remove this internal of_node_put() call so that of_map_id() now always transfers ownership of the matched node reference to the caller via arg->np. Callers are now consistently responsible for releasing this reference with of_node_put(arg->np) when done. Acked-by: Frank Li <Frank.Li@nxp.com> Suggested-by: Rob Herring (Arm) <robh@kernel.org> Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Charan Teja Kalla <charan.kalla@oss.qualcomm.com> Signed-off-by: Vijayanand Jitta <vijayanand.jitta@oss.qualcomm.com> Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-2-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org> 
Change of_map_id() to take a pointer to struct of_phandle_args
instead of passing target device node and translated IDs separately.
Update all callers accordingly.

Add an explicit filter_np parameter to of_map_id() and of_map_msi_id()
to separate the filter input from the output. Previously, the target
parameter served dual purpose: as an input filter (if non-NULL, only
match entries targeting that node) and as an output (receiving the
matched node with a reference held). Now filter_np is the explicit
input filter and arg->np is the pure output.

Previously, of_map_id() would call of_node_put() on the matched node
when a filter was provided, making reference ownership inconsistent.
Remove this internal of_node_put() call so that of_map_id() now always
transfers ownership of the matched node reference to the caller via
arg->np. Callers are now consistently responsible for releasing this
reference with of_node_put(arg->np) when done.

Acked-by: Frank Li <Frank.Li@nxp.com>
Suggested-by: Rob Herring (Arm) <robh@kernel.org>
Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Charan Teja Kalla <charan.kalla@oss.qualcomm.com>
Signed-off-by: Vijayanand Jitta <vijayanand.jitta@oss.qualcomm.com>
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-2-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
of: Add convenience wrappers for of_map_id() 2026-06-12T15:25:39+00:00 Robin Murphy robin.murphy@arm.com 2026-06-03T07:13:12+00:00 d4b52f83f198310c871aa71816a26152eb3898c2 Since we now have quite a few users parsing "iommu-map" and "msi-map" properties, give them some wrappers to conveniently encapsulate the appropriate sets of property names. This will also make it easier to then change of_map_id() to correctly account for specifier cells. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Marc Zyngier <maz@kernel.org> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Vijayanand Jitta <vijayanand.jitta@oss.qualcomm.com> Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-1-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org> 
Since we now have quite a few users parsing "iommu-map" and "msi-map"
properties, give them some wrappers to conveniently encapsulate the
appropriate sets of property names. This will also make it easier to
then change of_map_id() to correctly account for specifier cells.

Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Vijayanand Jitta <vijayanand.jitta@oss.qualcomm.com>
Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-1-dc509dacb19a@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>