Re: [PATCH 5/5] iommu/vt-d: Flush context cache with correct SID when tearing down aliases

On Fri, Jul 31, 2026 at 01:43:29PM +0800, Lu Baolu wrote:
>domain_context_clear_one() and device_pasid_table_teardown() are both
>invoked once per DMA alias of a device. Each function locates the context
>entry using the bus/devfn pair provided by the pci_for_each_dma_alias()
>callback, then calls intel_context_flush_no_pasid(), which constructs a
>device-selective context-cache invalidation from info->bus and
>info->devfn (that is, always the requester ID of the device itself).
>
>As a result, for every alias other than the device’s own RID, the context
>entry that was just cleared in memory is never invalidated in the context
>cache. Hardware may continue using that stale cached entry. In the
>scalable-mode teardown path, intel_pasid_free_table() can then free the
>PASID directory still referenced by that stale entry, allowing the IOMMU
>to walk freed memory.
>
>Fix this by passing the source ID of the entry being torn down to
>intel_context_flush_no_pasid(), instead of deriving it from @info.
>
>Fixes: f90584f4beb84 ("iommu/vt-d: Add helper to flush caches for context change")
>Reported-by: Sashiko <[email protected]>
>Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com
>Assisted-by: Claude:claude-opus-5
>Signed-off-by: Lu Baolu <[email protected]>
>---
> drivers/iommu/intel/iommu.h | 2 +-
> drivers/iommu/intel/iommu.c | 2 +-
> drivers/iommu/intel/pasid.c | 9 ++++++---
> 3 files changed, 8 insertions(+), 5 deletions(-)
>

Reviewed-by: Samiullah Khawaja <[email protected]>

Sami