RE: [PATCH 2/4] iommufd: Avoid locking internal accesses during unmap

"Tian, Kevin" <[email protected]> Mon, 27 Jul 2026 09:38:53 +0000

Newsgroups	dev.linux.lists.iommu,org.kernel.vger.linux-kernel
Message-ID	<CO1PR11MB4835927975B6AC736D4122618CCC2@CO1PR11MB4835.namprd11.prod.outlook.com>

> From: Shuai Xue <[email protected]>
> Sent: Sunday, July 26, 2026 3:44 PM
> 
> iommufd_access_notify_unmap() skips internal accesses because they do
> not have an external unmap callback to invoke.
> 
> However, the current test calls iommufd_lock_obj() before checking
> whether the access is internal. If iommufd_lock_obj() succeeds, the loop
> then sees the internal access and continues, bypassing the matching
> iommufd_put_object() used by the normal unmap path. This leaks the
> object reference taken by iommufd_lock_obj().
> 
> Check for internal accesses first so skipped entries are never locked.
> 
> Fixes: 27b77ea5feaa ("iommufd/access: Bypass access->ops->unmap for
> internal use")
> Cc: [email protected]
> Assisted-by: Qoder:Qwen-3.8-MAX-Preview
> Signed-off-by: Shuai Xue <[email protected]>

Reviewed-by: Kevin Tian <[email protected]>