Re: [PATCH rc v2 0/2] Do not UAF during iommufd_put_object()

[Jason Gunthorpe <jgg@nvidia.com>]

On Wed, Nov 22, 2023 at 09:13:17AM -0400, Jason Gunthorpe wrote:
> The mixture of kernel and user space lifecycle objects continues to be
> complicated inside iommufd. The obj->destroy_rwsem is used to bring order
> to the kernel driver destruction sequence but it cannot be sequenced right
> with the other refcounts so we end up possibly UAF'ing.
> 
> Fix it by using two refcounts and a wait queue to sequence the destruction
> process.
> 
> v2:
>  - Use refcount_inc_not_zero in both places in iommu_lock_obj() for
>    robustness
>  - Move the wait_event_timeout sequence into
>    iommufd_object_dec_wait_shortterm()
>  - Consistently dec users on the bug path to give close() a chance to
>    recover
>  - Change the order so if users reaches zero then we clean the xarray and
>    then unlock. Wait for shortterm to reach zero outside the lock
>  - Make iommufd_object_remove() non-static and use inlines to call it in
>    the various cases
>  - Comments
> v1: https://lore.kernel.org/r/0-v1-4c9a7fbb5702+107a-iommufd_syz4_jgg@nvidia.com
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> 
> Jason Gunthorpe (2):
>   iommufd: Add iommufd_ctx to iommufd_put_object()
>   iommufd: Do not UAF during iommufd_put_object()

Applied to the rc branch with the comment updates

Jason