diff options
| author | Jason Gunthorpe <[email protected]> | 2025-09-17 18:59:59 +0000 |
|---|---|---|
| committer | Jason Gunthorpe <[email protected]> | 2025-09-19 13:34:49 +0000 |
| commit | 53d0584eeb2c85a46c83656246d61a89558d74b3 (patch) | |
| tree | 237c300b208858c1226a817fc4c1626db7dd614c /fs/proc/generic.c | |
| parent | iommufd: Fix race during abort for file descriptors (diff) | |
| download | kernel-53d0584eeb2c85a46c83656246d61a89558d74b3.tar.gz kernel-53d0584eeb2c85a46c83656246d61a89558d74b3.zip | |
iommufd: WARN if an object is aborted with an elevated refcount
If something holds a refcount then it is at risk of UAFing. For abort
paths we expect the caller to never share the object with a parallel
thread and to clean up any refcounts it obtained on its own.
Add the missing dec inside iommufd_hwpt_paging_alloc() during error unwind
by making iommufd_hw_pagetable_attach/detach() proper pairs.
Link: https://patch.msgid.link/r/[email protected]
Reviewed-by: Kevin Tian <[email protected]>
Reviewed-by: Nicolin Chen <[email protected]>
Tested-by: Nicolin Chen <[email protected]>
Signed-off-by: Jason Gunthorpe <[email protected]>
Diffstat (limited to 'fs/proc/generic.c')
0 files changed, 0 insertions, 0 deletions