[PATCH] iommu/vt-d: Fix PASID reference leak

[PATCH] iommu/vt-d: Fix PASID reference leak

[Fenghua Yu]

A PASID reference is increased whenever a device is bound to an mm (and
its PASID) successfully (i.e. the device's sdev user count is increased).
But the reference is not dropped every time the device is unbound
successfully from the mm (i.e. the device's sdev user count is decreased).
The reference is dropped only once by calling intel_svm_free_pasid() when
there isn't any device bound to the mm. intel_svm_free_pasid() drops the
reference and only frees the PASID on zero reference.

Fix the issue by dropping the PASID reference and freeing the PASID when
no reference on successful unbinding the device by calling
intel_svm_free_pasid() .

Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
---
 drivers/iommu/intel/svm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
index 9b0f22bc0514..4b9b3f35ba0e 100644
--- a/drivers/iommu/intel/svm.c
+++ b/drivers/iommu/intel/svm.c
@@ -675,7 +675,6 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid)
 			kfree_rcu(sdev, rcu);
 
 			if (list_empty(&svm->devs)) {
-				intel_svm_free_pasid(mm);
 				if (svm->notifier.ops) {
 					mmu_notifier_unregister(&svm->notifier, mm);
 					/* Clear mm's pasid. */
@@ -690,6 +689,8 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid)
 				kfree(svm);
 			}
 		}
+		/* Drop a PASID reference and free it if no reference. */
+		intel_svm_free_pasid(mm);
 	}
 out:
 	return ret;
-- 
2.32.0

_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu

Re: [PATCH] iommu/vt-d: Fix PASID reference leak

[Lu Baolu]

On 2021/8/14 2:13, Fenghua Yu wrote:
> A PASID reference is increased whenever a device is bound to an mm (and
> its PASID) successfully (i.e. the device's sdev user count is increased).
> But the reference is not dropped every time the device is unbound
> successfully from the mm (i.e. the device's sdev user count is decreased).
> The reference is dropped only once by calling intel_svm_free_pasid() when
> there isn't any device bound to the mm. intel_svm_free_pasid() drops the
> reference and only frees the PASID on zero reference.
> 
> Fix the issue by dropping the PASID reference and freeing the PASID when
> no reference on successful unbinding the device by calling
> intel_svm_free_pasid() .
> 
> Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>

Nice catch! Thanks!

Fixes: 4048377414162 ("iommu/vt-d: Use iommu_sva_alloc(free)_pasid() 
helpers")
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>

Best regards,
baolu

> ---
>   drivers/iommu/intel/svm.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
> index 9b0f22bc0514..4b9b3f35ba0e 100644
> --- a/drivers/iommu/intel/svm.c
> +++ b/drivers/iommu/intel/svm.c
> @@ -675,7 +675,6 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid)
>   			kfree_rcu(sdev, rcu);
>   
>   			if (list_empty(&svm->devs)) {
> -				intel_svm_free_pasid(mm);
>   				if (svm->notifier.ops) {
>   					mmu_notifier_unregister(&svm->notifier, mm);
>   					/* Clear mm's pasid. */
> @@ -690,6 +689,8 @@ static int intel_svm_unbind_mm(struct device *dev, u32 pasid)
>   				kfree(svm);
>   			}
>   		}
> +		/* Drop a PASID reference and free it if no reference. */
> +		intel_svm_free_pasid(mm);
>   	}
>   out:
>   	return ret;
> 
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu

Re: [PATCH] iommu/vt-d: Fix PASID reference leak

[Lu Baolu]

On 2021/8/14 2:13, Fenghua Yu wrote:
> A PASID reference is increased whenever a device is bound to an mm (and
> its PASID) successfully (i.e. the device's sdev user count is increased).
> But the reference is not dropped every time the device is unbound
> successfully from the mm (i.e. the device's sdev user count is decreased).
> The reference is dropped only once by calling intel_svm_free_pasid() when
> there isn't any device bound to the mm. intel_svm_free_pasid() drops the
> reference and only frees the PASID on zero reference.
> 
> Fix the issue by dropping the PASID reference and freeing the PASID when
> no reference on successful unbinding the device by calling
> intel_svm_free_pasid() .
> 
> Signed-off-by: Fenghua Yu<fenghua.yu@intel.com>

Patch has been queued for iommu/fix.

Best regards,
baolu
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu