[PATCH 0/2] iommu/vt-d: Fix SVA teardown races with process exit

[Lu Baolu]

When a process using SVA exits while a device still has DMA and page
requests in flight for its PASID, the Intel IOMMU driver can mishandle
the teardown of that PASID. This series aims to fix two such issues.

The first is a use-after-free in the iopf handling path. After the
process exits, the later SVA unbind no longer drains the page request
queue for the PASID before the SVA attach handle is freed. Page
requests queued before the exit are then handled by
iommu_sva_handle_iopf() on the freed handle.

The second is a race between process exit and an SVA unbind of the
PASID. The mm release callback can return before the unbind completes
invalidating the PASID cache, IOTLB and device TLB. The exiting process
may then free its page tables while the IOMMU and the device still hold
translations that reference them.

Please review and comments.

Lu Baolu (2):
  iommu/vt-d: Set FPD when tearing down a PASID entry with fault_ignore
  iommu/vt-d: Serialize SVA unbind teardown with intel_mm_release()

 drivers/iommu/intel/pasid.h | 11 +++++++++++
 drivers/iommu/intel/iommu.c | 10 ++++++++++
 drivers/iommu/intel/pasid.c | 30 +++++++++++-------------------
 3 files changed, 32 insertions(+), 19 deletions(-)

-- 
2.43.0