Re: [PATCH 1/3] iommufd: Fix race during abort for file descriptors

[Jason Gunthorpe <jgg@nvidia.com>]

On Wed, Sep 17, 2025 at 10:07:38PM -0700, Nicolin Chen wrote:
> On Wed, Sep 17, 2025 at 05:01:47PM -0300, Jason Gunthorpe wrote:
> > Fix this by putting the core code in charge of the file lifetime, and call
> > __fput_sync() during abort to ensure that release() is called before
> > kfree. __fput_sync() is a bit too tricky to open code in all the object
> > implementations
> 
> Mind elaborating this "too tricky"? I thought that we're supposed
> to use __fput_sync(), instead of fput(), in the alloc function in
> the first place?

I don't think anything should be widely using __fput_sync(), that's
really weird and special. Our strange refcounting cycle is what
motivates this.

Drivers should be using normal fput().

> > +		/*
> > +		 * files should hold a users refcount while the file is open and
> > +		 * put it back in their release. They should hold a pointer to
> > +		 * obj in their private data. Normal fput() is deferred to a
> 
> Nit: there is only one file_offset per obj, so it should be "file"
> and "it/its"?

Ok

Thanks,
Jason