Re: [PATCH] iommu/vt-d: Fix PASID reference leak

[Lu Baolu <baolu.lu@linux.intel.com>]

On 2021/8/14 2:13, Fenghua Yu wrote:
> A PASID reference is increased whenever a device is bound to an mm (and
> its PASID) successfully (i.e. the device's sdev user count is increased).
> But the reference is not dropped every time the device is unbound
> successfully from the mm (i.e. the device's sdev user count is decreased).
> The reference is dropped only once by calling intel_svm_free_pasid() when
> there isn't any device bound to the mm. intel_svm_free_pasid() drops the
> reference and only frees the PASID on zero reference.
> 
> Fix the issue by dropping the PASID reference and freeing the PASID when
> no reference on successful unbinding the device by calling
> intel_svm_free_pasid() .
> 
> Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>

Nice catch! Thanks!

Fixes: 4048377414162 ("iommu/vt-d: Use iommu_sva_alloc(free)_pasid() 
helpers")
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>

Best regards,
baolu

> ---
>   drivers/iommu/intel/svm.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
> index 9b0f22bc0514..4b9b3f35ba0e 100644
> --- a/drivers/iommu/intel/svm.c
> +++ b/drivers/iommu/intel/svm.c
> @@ -675,7 +675,6 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid)
>   			kfree_rcu(sdev, rcu);
>   
>   			if (list_empty(&svm->devs)) {
> -				intel_svm_free_pasid(mm);
>   				if (svm->notifier.ops) {
>   					mmu_notifier_unregister(&svm->notifier, mm);
>   					/* Clear mm's pasid. */
> @@ -690,6 +689,8 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid)
>   				kfree(svm);
>   			}
>   		}
> +		/* Drop a PASID reference and free it if no reference. */
> +		intel_svm_free_pasid(mm);
>   	}
>   out:
>   	return ret;
> 
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu