Re: [PATCH 5/5] iommu/vt-d: Flush context cache with correct SID when tearing down aliases

[Samiullah Khawaja]

On Fri, Jul 31, 2026 at 01:43:29PM +0800, Lu Baolu wrote:
> domain_context_clear_one() and device_pasid_table_teardown() are both
> invoked once per DMA alias of a device. Each function locates the context
> entry using the bus/devfn pair provided by the pci_for_each_dma_alias()
> callback, then calls intel_context_flush_no_pasid(), which constructs a
> device-selective context-cache invalidation from info->bus and
> info->devfn (that is, always the requester ID of the device itself).
>
> As a result, for every alias other than the device’s own RID, the context
> entry that was just cleared in memory is never invalidated in the context
> cache. Hardware may continue using that stale cached entry. In the
> scalable-mode teardown path, intel_pasid_free_table() can then free the
> PASID directory still referenced by that stale entry, allowing the IOMMU
> to walk freed memory.
>
> Fix this by passing the source ID of the entry being torn down to
> intel_context_flush_no_pasid(), instead of deriving it from @info.
>
> Fixes: f90584f4beb84 ("iommu/vt-d: Add helper to flush caches for context change")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Lu Baolu <baolu.lu@xxxxxxxxxxxxxxx>
> ---
> drivers/iommu/intel/iommu.h | 2 +-
> drivers/iommu/intel/iommu.c | 2 +-
> drivers/iommu/intel/pasid.c | 9 ++++++---
> 3 files changed, 8 insertions(+), 5 deletions(-)

Reviewed-by: Samiullah Khawaja <skhawaja@xxxxxxxxxx>

Sami