iommu/arm-smmu: Fix group refcounting

When arm_smmu_device_group() finds an existing group due to Stream ID
aliasing, it should be taking an additional reference on that group.
Otherwise, the caller of iommu_group_get_for_dev() will inadvertently
remove the reference taken by iommu_group_add_device(), and the group
will be freed prematurely if any device is removed.

Reported-by: Sricharan R <sricharan@codeaurora.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>

diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index c841eb7a1a7417af301e6c51a9ba464d05b1472a..b85fa2471738f8c506e882540c177a8ae414d9f0 100644 (file)
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1466,7 +1466,7 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev)
        }
 
        if (group)
-               return group;
+               return iommu_group_ref_get(group);
 
        if (dev_is_pci(dev))
                group = pci_device_group(dev);