Re: [PATCH 5/5] iommu/vt-d: Flush context cache with correct SID when tearing down aliases

[Samiullah Khawaja <skhawaja@google.com>]

On Fri, Jul 31, 2026 at 01:43:29PM +0800, Lu Baolu wrote:
>domain_context_clear_one() and device_pasid_table_teardown() are both
>invoked once per DMA alias of a device. Each function locates the context
>entry using the bus/devfn pair provided by the pci_for_each_dma_alias()
>callback, then calls intel_context_flush_no_pasid(), which constructs a
>device-selective context-cache invalidation from info->bus and
>info->devfn (that is, always the requester ID of the device itself).
>
>As a result, for every alias other than the device’s own RID, the context
>entry that was just cleared in memory is never invalidated in the context
>cache. Hardware may continue using that stale cached entry. In the
>scalable-mode teardown path, intel_pasid_free_table() can then free the
>PASID directory still referenced by that stale entry, allowing the IOMMU
>to walk freed memory.
>
>Fix this by passing the source ID of the entry being torn down to
>intel_context_flush_no_pasid(), instead of deriving it from @info.
>
>Fixes: f90584f4beb84 ("iommu/vt-d: Add helper to flush caches for context change")
>Reported-by: Sashiko <sashiko-bot@kernel.org>
>Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com
>Assisted-by: Claude:claude-opus-5
>Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
>---
> drivers/iommu/intel/iommu.h | 2 +-
> drivers/iommu/intel/iommu.c | 2 +-
> drivers/iommu/intel/pasid.c | 9 ++++++---
> 3 files changed, 8 insertions(+), 5 deletions(-)
>

Reviewed-by: Samiullah Khawaja <skhawaja@google.com>

Sami