diff options
| author | Jason Gunthorpe <jgg@nvidia.com> | 2025-09-17 15:59:59 -0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2025-09-19 10:34:49 -0300 |
| commit | 53d0584eeb2c85a46c83656246d61a89558d74b3 (patch) | |
| tree | 237c300b208858c1226a817fc4c1626db7dd614c /tools/docs/lib/parse_data_structs.py | |
| parent | 4e034bf045b12852a24d5d33f2451850818ba0c1 (diff) | |
iommufd: WARN if an object is aborted with an elevated refcount
If something holds a refcount then it is at risk of UAFing. For abort
paths we expect the caller to never share the object with a parallel
thread and to clean up any refcounts it obtained on its own.
Add the missing dec inside iommufd_hwpt_paging_alloc() during error unwind
by making iommufd_hw_pagetable_attach/detach() proper pairs.
Link: https://patch.msgid.link/r/2-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'tools/docs/lib/parse_data_structs.py')
0 files changed, 0 insertions, 0 deletions