Description of problem:

When the iommu feature is negotiated, Qemu crashes when backend disconnects first.

Two issues:
1. IOMMU UNMAP notifications are still propagated to the user backend, but the vhost_dev struct has been destroyed.
2. If the bacvkend just sent an IOTLB miss request before disconnecting, the request handling on Qemu side can happen after the vhost_dev has been destroyed because the slave fd handler is not unregistered had vhost_dev stop time.

Set severity as low since no vhost-user backend using IOMMU are available upstream. DPDK is expected to support it by v17.11 release.

Version-Release number of selected component (if applicable):


How reproducible:
100% for crash 1, 75% for crash 2 (depends whether IOTLB miss on-going at disconnect time).

Steps to Reproduce:

1. Use DPDK's testpmd on host with vhost-user backend that supports IOMMU.
2. Attach an IOMMU to the Virtio device in Qemu.
3. Use Virtio-net Kernel driver on guest side, so that lots of IOTLB miss are sent by the backend
4. set host's testpmd in txonly mode to flood the guest
5. quit testpmd

Actual results:

2 types of segmentation faults

Expected results:

No crash

Additional info:

Patches available & merged into upstream's master:

commit b9ec9bd468b2c5b218d16642e8f8ea4df60418bb
Author: Maxime Coquelin <maxime.coquelin>
Date:   Fri Jun 30 18:04:22 2017 +0200

    vhost-user: unregister slave req handler at cleanup time
    
    If the backend sends a request just before closing the socket,
    the aio dispatcher might schedule its reading after the vhost
    device has been cleaned, leading to a NULL pointer dereference
    in slave_read();
    
    vhost_user_cleanup() already closes the socket but it is not
    enough, the handler has to be unregistered.
    
    Signed-off-by: Maxime Coquelin <maxime.coquelin>
    Reviewed-by: Marc-André Lureau <marcandre.lureau>
    Reviewed-by: Michael S. Tsirkin <mst>
    Signed-off-by: Michael S. Tsirkin <mst>

commit 384b557da1a44ce260cd0328c06a250507348f73
Author: Maxime Coquelin <maxime.coquelin>
Date:   Fri Jun 30 18:04:21 2017 +0200

    vhost: ensure vhost_ops are set before calling iotlb callback
    
    This patch fixes a crash that happens when vhost-user iommu
    support is enabled and vhost-user socket is closed.
    
    When it happens, if an IOTLB invalidation notification is sent
    by the IOMMU, vhost_ops's NULL pointer is dereferenced.
    
    Signed-off-by: Maxime Coquelin <maxime.coquelin>
    Reviewed-by: Marc-André Lureau <marcandre.lureau>
    Reviewed-by: Michael S. Tsirkin <mst>
    Signed-off-by: Michael S. Tsirkin <mst>