Re: [PATCH V2] iommu/sva: Fix crash in iommu_sva_unbind_device()

Yi Liu
2026-03-06T10:03:50Z

On 3/5/26 14:18, Lizhi Hou wrote:
> domain->mm->iommu_mm can be freed by iommu_domain_free():
> iommu_domain_free()
> mmdrop()
> __mmdrop()
> mm_pasid_drop()
> After iommu_domain_free() returns, accessing domain->mm->iommu_mm may
> dereference a freed mm structure, leading to a crash.
>
> Fix this by moving the code that accesses domain->mm->iommu_mm to before
> the call to iommu_domain_free().
>
> Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
> drivers/iommu/iommu-sva.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c
> index 07d64908a05f..bc7c7232a43e 100644
> --- a/drivers/iommu/iommu-sva.c
> +++ b/drivers/iommu/iommu-sva.c
> @@ -182,13 +182,13 @@ void iommu_sva_unbind_device(struct iommu_sva *handle)
> iommu_detach_device_pasid(domain, dev, iommu_mm->pasid);
> if (--domain->users == 0) {
> list_del(&domain->next);
> - iommu_domain_free(domain);
> - }
> + if (list_empty(&iommu_mm->sva_domains)) {
> + list_del(&iommu_mm->mm_list_elm);
> + if (list_empty(&iommu_sva_mms))
> + iommu_sva_present = false;
> + }
>
> - if (list_empty(&iommu_mm->sva_domains)) {
> - list_del(&iommu_mm->mm_list_elm);
> - if (list_empty(&iommu_sva_mms))
> - iommu_sva_present = false;
> + iommu_domain_free(domain);
> }
>
> mutex_unlock(&iommu_sva_lock);

Reviewed-by: Yi Liu <yi.l.liu@intel.com>

Regards,
Yi Liu