Re: [PATCH rc v2 2/2] iommufd: Do not UAF during iommufd_put_object()

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Nov 28, 2023 at 07:59:29AM +0000, Tian, Kevin wrote:
> > From: Jason Gunthorpe <jgg@nvidia.com>
> > Sent: Friday, November 24, 2023 8:50 PM
> > 
> > On Fri, Nov 24, 2023 at 06:48:59AM +0000, Tian, Kevin wrote:
> > > > From: Jason Gunthorpe <jgg@nvidia.com>
> > > > Sent: Wednesday, November 22, 2023 9:13 PM
> > > >
> > > > +		if (ret) {
> > > > +			/*
> > > > +			 * We have a bug. Put back the callers reference and
> > > > +			 * defer cleaning this object until close.
> > > > +			 */
> > > > +			refcount_dec(&to_destroy->users);
> > >
> > > explain why refcount_dec means 'put back'? also 'put back' is
> > > inconsistent with the earlier comment "In all cases the caller no
> > > longer has a users reference "
> > 
> > As above, "put back" means to have effectively done iommufd_put_object()
> > 
> 
> Probably just my English problem on the confusion that here 'put back'
> means removing the users refcnt of the caller while later 'put back'
> means adding back the shortterm refcnt in the error path:
> 
> +err_xa:
> +	if (zerod_shortterm) {
> +		/* Put back the xarray owned reference */
> +		refcount_set(&obj->shortterm_users, 1);
> +	}

Let's use the word 'restore' here instead of 'put back' :)

Thanks,
Jason