* [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()
@ 2026-03-05 6:18 Lizhi Hou
2026-03-06 5:35 ` Baolu Lu
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Lizhi Hou @ 2026-03-05 6:18 UTC (permalink / raw)
To: joro, will, robin.murphy, yi.l.liu
Cc: Lizhi Hou, iommu, linux-kernel, baolu.lu, vasant.hegde
domain->mm->iommu_mm can be freed by iommu_domain_free():
iommu_domain_free()
mmdrop()
__mmdrop()
mm_pasid_drop()
After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
dereference a freed mm structure, leading to a crash.
Fix this by moving the code that accesses domain->mm->iommu_mm to before
the call to iommu_domain_free().
Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/iommu/iommu-sva.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
index 07d64908a05f..bc7c7232a43e 100644
--- a/drivers/iommu/iommu-sva.c
+++ b/drivers/iommu/iommu-sva.c
@@ -182,13 +182,13 @@ void iommu_sva_unbind_device(struct iommu_sva *handle)
iommu_detach_device_pasid(domain, dev, iommu_mm->pasid);
if (--domain->users == 0) {
list_del(&domain->next);
- iommu_domain_free(domain);
- }
+ if (list_empty(&iommu_mm->sva_domains)) {
+ list_del(&iommu_mm->mm_list_elm);
+ if (list_empty(&iommu_sva_mms))
+ iommu_sva_present = false;
+ }
- if (list_empty(&iommu_mm->sva_domains)) {
- list_del(&iommu_mm->mm_list_elm);
- if (list_empty(&iommu_sva_mms))
- iommu_sva_present = false;
+ iommu_domain_free(domain);
}
mutex_unlock(&iommu_sva_lock);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()
2026-03-05 6:18 [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device() Lizhi Hou
@ 2026-03-06 5:35 ` Baolu Lu
2026-03-06 9:55 ` Vasant Hegde
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Baolu Lu @ 2026-03-06 5:35 UTC (permalink / raw)
To: Lizhi Hou, joro, will, robin.murphy, yi.l.liu
Cc: iommu, linux-kernel, vasant.hegde
On 3/5/26 14:18, Lizhi Hou wrote:
> domain->mm->iommu_mm can be freed by iommu_domain_free():
> iommu_domain_free()
> mmdrop()
> __mmdrop()
> mm_pasid_drop()
> After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
> dereference a freed mm structure, leading to a crash.
>
> Fix this by moving the code that accesses domain->mm->iommu_mm to before
> the call to iommu_domain_free().
>
> Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
> Signed-off-by: Lizhi Hou<lizhi.hou@amd.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()
2026-03-05 6:18 [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device() Lizhi Hou
2026-03-06 5:35 ` Baolu Lu
@ 2026-03-06 9:55 ` Vasant Hegde
2026-03-06 10:11 ` Yi Liu
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Vasant Hegde @ 2026-03-06 9:55 UTC (permalink / raw)
To: Lizhi Hou, joro, will, robin.murphy, yi.l.liu
Cc: iommu, linux-kernel, baolu.lu
On 3/5/2026 11:48 AM, Lizhi Hou wrote:
> domain->mm->iommu_mm can be freed by iommu_domain_free():
> iommu_domain_free()
> mmdrop()
> __mmdrop()
> mm_pasid_drop()
> After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
> dereference a freed mm structure, leading to a crash.
>
> Fix this by moving the code that accesses domain->mm->iommu_mm to before
> the call to iommu_domain_free().
>
> Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
-Vasant
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()
2026-03-05 6:18 [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device() Lizhi Hou
2026-03-06 5:35 ` Baolu Lu
2026-03-06 9:55 ` Vasant Hegde
@ 2026-03-06 10:11 ` Yi Liu
2026-03-12 13:41 ` Jason Gunthorpe
2026-03-17 13:00 ` Jörg Rödel
4 siblings, 0 replies; 6+ messages in thread
From: Yi Liu @ 2026-03-06 10:11 UTC (permalink / raw)
To: Lizhi Hou, joro, will, robin.murphy
Cc: iommu, linux-kernel, baolu.lu, vasant.hegde
On 3/5/26 14:18, Lizhi Hou wrote:
> domain->mm->iommu_mm can be freed by iommu_domain_free():
> iommu_domain_free()
> mmdrop()
> __mmdrop()
> mm_pasid_drop()
> After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
> dereference a freed mm structure, leading to a crash.
>
> Fix this by moving the code that accesses domain->mm->iommu_mm to before
> the call to iommu_domain_free().
>
> Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
> drivers/iommu/iommu-sva.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
> index 07d64908a05f..bc7c7232a43e 100644
> --- a/drivers/iommu/iommu-sva.c
> +++ b/drivers/iommu/iommu-sva.c
> @@ -182,13 +182,13 @@ void iommu_sva_unbind_device(struct iommu_sva *handle)
> iommu_detach_device_pasid(domain, dev, iommu_mm->pasid);
> if (--domain->users == 0) {
> list_del(&domain->next);
> - iommu_domain_free(domain);
> - }
> + if (list_empty(&iommu_mm->sva_domains)) {
> + list_del(&iommu_mm->mm_list_elm);
> + if (list_empty(&iommu_sva_mms))
> + iommu_sva_present = false;
> + }
>
> - if (list_empty(&iommu_mm->sva_domains)) {
> - list_del(&iommu_mm->mm_list_elm);
> - if (list_empty(&iommu_sva_mms))
> - iommu_sva_present = false;
> + iommu_domain_free(domain);
> }
>
> mutex_unlock(&iommu_sva_lock);
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Regards,
Yi Liu
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()
2026-03-05 6:18 [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device() Lizhi Hou
` (2 preceding siblings ...)
2026-03-06 10:11 ` Yi Liu
@ 2026-03-12 13:41 ` Jason Gunthorpe
2026-03-17 13:00 ` Jörg Rödel
4 siblings, 0 replies; 6+ messages in thread
From: Jason Gunthorpe @ 2026-03-12 13:41 UTC (permalink / raw)
To: Lizhi Hou
Cc: joro, will, robin.murphy, yi.l.liu, iommu, linux-kernel, baolu.lu,
vasant.hegde
On Wed, Mar 04, 2026 at 10:18:42PM -0800, Lizhi Hou wrote:
> domain->mm->iommu_mm can be freed by iommu_domain_free():
> iommu_domain_free()
> mmdrop()
> __mmdrop()
> mm_pasid_drop()
> After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
> dereference a freed mm structure, leading to a crash.
>
> Fix this by moving the code that accesses domain->mm->iommu_mm to before
> the call to iommu_domain_free().
>
> Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
Cc: stable@vger.kernel.org
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
> drivers/iommu/iommu-sva.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Jason
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()
2026-03-05 6:18 [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device() Lizhi Hou
` (3 preceding siblings ...)
2026-03-12 13:41 ` Jason Gunthorpe
@ 2026-03-17 13:00 ` Jörg Rödel
4 siblings, 0 replies; 6+ messages in thread
From: Jörg Rödel @ 2026-03-17 13:00 UTC (permalink / raw)
To: Lizhi Hou
Cc: will, robin.murphy, yi.l.liu, iommu, linux-kernel, baolu.lu,
vasant.hegde
On Wed, Mar 04, 2026 at 10:18:42PM -0800, Lizhi Hou wrote:
> domain->mm->iommu_mm can be freed by iommu_domain_free():
> iommu_domain_free()
> mmdrop()
> __mmdrop()
> mm_pasid_drop()
> After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
> dereference a freed mm structure, leading to a crash.
>
> Fix this by moving the code that accesses domain->mm->iommu_mm to before
> the call to iommu_domain_free().
>
> Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
> drivers/iommu/iommu-sva.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-03-17 13:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-05 6:18 [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device() Lizhi Hou
2026-03-06 5:35 ` Baolu Lu
2026-03-06 9:55 ` Vasant Hegde
2026-03-06 10:11 ` Yi Liu
2026-03-12 13:41 ` Jason Gunthorpe
2026-03-17 13:00 ` Jörg Rödel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox