On 2024/12/11 15:21, Tian, Kevin wrote:
From: Lu Baolu<baolu.lu@xxxxxxxxxxxxxxx>
Sent: Friday, November 29, 2024 10:05 AM
The current implementation removes cache tags after disabling ATS,
leading to potential memory leaks and kernel crashes. Specifically,
CACHE_TAG_DEVTLB type cache tags may still remain in the list even
after the domain is freed, causing a use-after-free condition.
This issue really shows up when multiple VFs from different PFs
passed through to a single user-space process via vfio-pci. In such
cases, the kernel may crash with kernel messages like:
Is "multiple VFs from different PFs" the key to trigger the problem?
This is the real test case that triggered this issue. It's definitely
not the only case that could trigger this issue.
what about multiple VFs from the same PF or just assigning multiple
devices to a single process/vm?
I think it's possible.
My understanding from the below fix is that this issue will be triggered
as long as the domain is still being actively used after one device with
ATS is detached from it, i.e. sounds like a problem in multi-device
assignment scenario.
Yes.
Thanks,
baolu
