linux-kernel - Re: [PATCH v2 1/4] iommufd: Add iommufd_object_tombstone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250624133520.GA150753@nvidia.com>
Date: Tue, 24 Jun 2025 10:35:20 -0300
From: Jason Gunthorpe <jgg@...dia.com>
To: Xu Yilun <yilun.xu@...ux.intel.com>
Cc: kevin.tian@...el.com, will@...nel.org, aneesh.kumar@...nel.org,
	iommu@...ts.linux.dev, linux-kernel@...r.kernel.org,
	joro@...tes.org, robin.murphy@....com, shuah@...nel.org,
	nicolinc@...dia.com, aik@....com, dan.j.williams@...el.com,
	baolu.lu@...ux.intel.com, yilun.xu@...el.com
Subject: Re: [PATCH v2 1/4] iommufd: Add iommufd_object_tombstone_user()
 helper

On Mon, Jun 23, 2025 at 05:49:43PM +0800, Xu Yilun wrote:
> @@ -251,16 +252,30 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
>  	 */
>  	while (!xa_empty(&ictx->objects)) {
>  		unsigned int destroyed = 0;
> -		unsigned long index;
>  
> -		xa_for_each(&ictx->objects, index, obj) {
> -			if (!refcount_dec_if_one(&obj->users))
> -				continue;

I don't think you need all these changes..

xa_for_each will skip the XA_ZERO_ENTRIES because it won't return NULL

xa_empty() will fail, but just remove it.

@@ -288,6 +288,7 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
        struct iommufd_sw_msi_map *next;
        struct iommufd_sw_msi_map *cur;
        struct iommufd_object *obj;
+       bool empty;
 
        /*
         * The objects in the xarray form a graph of "users" counts, and we have
@@ -298,11 +299,13 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
         * until the entire list is destroyed. If this can't progress then there
         * is some bug related to object refcounting.
         */
-       while (!xa_empty(&ictx->objects)) {
+       do {
                unsigned int destroyed = 0;
                unsigned long index;
 
+               empty = true;
                xa_for_each(&ictx->objects, index, obj) {
+                       empty = false;
                        if (!refcount_dec_if_one(&obj->users))
                                continue;
                        destroyed++;
@@ -313,8 +316,13 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
                /* Bug related to users refcount */
                if (WARN_ON(!destroyed))
                        break;
-       }
-       WARN_ON(!xa_empty(&ictx->groups));
+       } while (!empty);
+
+       /*
+        * There may be some tombstones left over from
+        * iommufd_object_tombstone_user()
+        */
+       xa_destroy(&ictx->groups);


Jason