Re: [PATCH] iommufd: Fix refcounting race during mmap

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Sep 16, 2025 at 01:10:07PM -0300, Jason Gunthorpe wrote:
> The owner object of the imap can be destroyed while the imap remains in
> the mtree. So access to the imap pointer without holding locks is racy
> with destruction.
> 
> The imap is safe to access outside the lock once a users refcount is
> obtained, the owner object cannot start destruction until users is 0.
> 
> Thus the users refcount should not be obtained at the end of
> iommufd_fops_mmap() but instead inside the mtree lock held around the
> mtree_load(). Move the refcount there and use refcount_inc_not_zero() as
> we can have a 0 refcount inside the mtree during destruction races.
> 
> Cc: stable@vger.kernel.org
> Fixes: 56e9a0d8e53f ("iommufd: Add mmap interface")
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  drivers/iommu/iommufd/main.c | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)

Applied to for-rc

Jason