[PATCH 0/3] iommu/amd/iommu_v2: Fix refcount related issues

[Vasant Hegde <vasant.hegde@amd.com>]

This patch series fixes various issues around pasid refcount handling.

Issues addressed in this patchset are as follows:

1. refcount_dec assumes that refcount will never reach 0:
   threfore: REFCOUNT_WARN("decrement hit 0; leaking memory")
   will be invoked on pasid unbind

   *  Fixed by changing refcount_dec to refcount_dec_and_test
      to explicitly handle refcount=1 (skip waiting for wait queue)

2. ppr_handler calls the wake_up API on the pasid_state wait_queue.
   However, once refcount has been decremented, unbind_pasid may have
   already freed this object - causing unallocated memory access

   *  Fixed by adding spinlock to ensure atomicity between refcount
      check and event queue handling. Moved wait_queue APIs to
      wake_up_locked / wake_event_interruptible_locked accordingly

3. If new ppr_handler arrives after get_pasid_wait once pasid unbind
   has decremented refcount to 0 - get_pasid_state can still acquire
   a pointer to pasid_state after being freed by unbind_pasid causing
   unallocated memory access

   *  Fixed by changing ref_count_inc to ref_count_inc_not_zero
      to ensure no new ppr_handle starts after pasid has been unbound
      and NULL (invalid) pasid_state is returned on zero.

Signed-off-by: Daniel Marcovitch <dmarcovitch@nvidia.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>

Base commit: v6.2-rc5

Daniel Marcovitch (3):
  iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind
  iommu/amd/iommu_v2: Fix pasid_state->wq race
  iommu/amd/iommu_v2: Prevent scheduling new ppr notifier during unbind_pasid

 drivers/iommu/amd/iommu_v2.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

-- 
2.31.1