RE: [PATCH 2/3] iommufd: WARN if an object is aborted with an elevated refcount

Tian, Kevin
2025-09-19T08:16:50Z

> From: Jason Gunthorpe <jgg@nvidia.com>
> Sent: Thursday, September 18, 2025 4:02 AM
>
> If something holds a refcount then it is at risk of UAFing. For abort
> paths we expect the caller to never share the object with a parallel
> thread and to clean up any refcounts it obtained on its own.
>
> Add the missing dec inside iommufd_hwpt_paging_alloc()during error
> unwind
> by making iommufd_hw_pagetable_attach/detach() proper pairs.
>
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>