> viommu_remove() resets the device and deletes the virtqueues while
> userspace may still hold domains that it maps or attaches, and nothing
> stopped a request from being queued - or a drain from walking the queue -
> on a virtqueue that was being torn down.
>
> Set ->removed under request_lock before the teardown - the lock a
> queueing path holds while it checks liveness and adds the request, and
> the one the drain holds for its whole run - check it in the queueing
> helper, and let the drain return early when it is set.
>
> A drain that returns early leaves the requests still on the queue
> behind, and the device cannot complete them either. Detach them
> from the request virtqueue - which unmaps their DMA mappings - and
> free them after the device is reset, when it can no longer be using
> them, and before the queues are deleted, so that the objects do not
> leak.
>
> Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver")
> Signed-off-by: Anlai Lu <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=4
