Re: [PATCH 3/3] iommu/amd/iommu_v2: Prevent scheduling new ppr notifier during unbind_pasid

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Jan 24, 2023 at 10:43:55AM +0000, Vasant Hegde wrote:
> From: Daniel Marcovitch <dmarcovitch@nvidia.com>
> 
> The pasid state wait_queue / ref_count mechanism allows unbind_pasid to
> wait for all outstanding ppr requests to be completed prior to freeing
> pasid_state.
> 
> However, we are still missing a mechanism to prevent new ppr_notifier
> being invoked after refcount has been decremented to 0, and prior to
> pasid_state deallocation.
> 
> This can cause unallocated memory access.
> 
> Fixed by changing ref_count_inc to ref_count_inc_not_zero to ensure no
> new ppr_handler starts after pasid has been unbound and NULL (invalid)
> pasid_state is returned on zero.

It looks like this is prevented by clear_pasid_state() which will NULL
the pasid entry under the spinlock before an attempt is made to zero
the refcount?

Though maybe that is missed in the free_pasid_states() path?

Also this whole thing is just begging to be converted into an xarray..

Jason