Linux kernel (drivers/iommu/amd): Unbinding a PASID races the I/O page-fault (PPR) notifications still in flight

Impact

Unbinding a PASID races the I/O page-fault (PPR) notifications still in flight against it. The refcount that is supposed to keep the PASID state alive until outstanding faults drain hits zero on the unbind path, so the state object can be torn down while the fault handler is still using it - a PASID/SVA lifetime break on AMD-Vi. Upstream's observable is a refcount warning plus leaked state rather than a demonstrated use-after-free.

Who can reach it

A process using AMD SVA/PASID that unbinds while its device still has page-fault requests outstanding - i.e. a tenant workload that programs a PASID-capable accelerator and exits with DMA still pending. No host root. Conditional on AMD-Vi with the iommu_v2 PASID/PPR path in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not enable SVA/PASID for tenant workloads on unpatched AMD-Vi hosts.

References