diff options
| author | Jason Gunthorpe <jgg@nvidia.com> | 2026-06-09 03:20:25 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-06-09 03:20:25 +0300 |
| commit | f2d70dbd3dcefa8e3c380beff9c31f5f033a4221 (patch) | |
| tree | 63c6dc7c81a915e3711f365ad63f2edc174a5557 | |
| parent | e745cd2c749e557c14a15ac931761c3f58c24489 (diff) | |
| download | linux-f2d70dbd3dcefa8e3c380beff9c31f5f033a4221.tar.xz | |
iommufd: Destroy the pages content after detaching from dmabuf
Sashiko points out this has gotten out of order, the mutex could still be
in use through the dmabuf invalidation callbacks. Don't destroy any of the
pages content until the dmabuf is fully detached.
Fixes: 71db84a092c3 ("iommufd: Add DMABUF to iopt_pages")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
| -rw-r--r-- | drivers/iommu/iommufd/pages.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 7b64002e54b9..03c8379bbc34 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1656,10 +1656,6 @@ void iopt_release_pages(struct kref *kref) WARN_ON(!RB_EMPTY_ROOT(&pages->domains_itree.rb_root)); WARN_ON(pages->npinned); WARN_ON(!xa_empty(&pages->pinned_pfns)); - mmdrop(pages->source_mm); - mutex_destroy(&pages->mutex); - put_task_struct(pages->source_task); - free_uid(pages->source_user); if (iopt_is_dmabuf(pages) && pages->dmabuf.attach) { struct dma_buf *dmabuf = pages->dmabuf.attach->dmabuf; @@ -1672,6 +1668,10 @@ void iopt_release_pages(struct kref *kref) } else if (pages->type == IOPT_ADDRESS_FILE) { fput(pages->file); } + mmdrop(pages->source_mm); + mutex_destroy(&pages->mutex); + put_task_struct(pages->source_task); + free_uid(pages->source_user); kfree(pages); } |