diff options
| author | Daniel Marcovitch <dmarcovitch@nvidia.com> | 2023-06-09 10:51:45 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-09-13 09:42:50 +0200 |
| commit | 13ed255248dfbbb7f23f9170c7a537fb9ca22c73 (patch) | |
| tree | 50942c06474094cfc63f6a6b26800ce5080efc93 /drivers/iommu | |
| parent | 25afb3e03bf8ab02567af4b6ffbfd6250a91a9f8 (diff) | |
| download | linux-stable-13ed255248dfbbb7f23f9170c7a537fb9ca22c73.tar.gz linux-stable-13ed255248dfbbb7f23f9170c7a537fb9ca22c73.tar.bz2 linux-stable-13ed255248dfbbb7f23f9170c7a537fb9ca22c73.zip | |
iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind
[ Upstream commit 534103bcd52ca9c1fecbc70e717b4a538dc4ded8 ]
When unbinding pasid - a race condition exists vs outstanding page faults.
To prevent this, the pasid_state object contains a refcount.
* set to 1 on pasid bind
* incremented on each ppr notification start
* decremented on each ppr notification done
* decremented on pasid unbind
Since refcount_dec assumes that refcount will never reach 0:
the current implementation causes the following to be invoked on
pasid unbind:
REFCOUNT_WARN("decrement hit 0; leaking memory")
Fix this issue by changing refcount_dec to refcount_dec_and_test
to explicitly handle refcount=1.
Fixes: 8bc54824da4e ("iommu/amd: Convert from atomic_t to refcount_t on pasid_state->count")
Signed-off-by: Daniel Marcovitch <dmarcovitch@nvidia.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Link: https://lore.kernel.org/r/20230609105146.7773-2-vasant.hegde@amd.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/iommu')
| -rw-r--r-- | drivers/iommu/amd/iommu_v2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/iommu/amd/iommu_v2.c b/drivers/iommu/amd/iommu_v2.c index 75355ddca657..4caa023048a0 100644 --- a/drivers/iommu/amd/iommu_v2.c +++ b/drivers/iommu/amd/iommu_v2.c @@ -262,8 +262,8 @@ static void put_pasid_state(struct pasid_state *pasid_state) static void put_pasid_state_wait(struct pasid_state *pasid_state) { - refcount_dec(&pasid_state->count); - wait_event(pasid_state->wq, !refcount_read(&pasid_state->count)); + if (!refcount_dec_and_test(&pasid_state->count)) + wait_event(pasid_state->wq, !refcount_read(&pasid_state->count)); free_pasid_state(pasid_state); } |