Re: [PATCH 2/3] iommufd: WARN if an object is aborted with an elevated refcount

On Wed, Sep 17, 2025 at 05:01:48PM -0300, Jason Gunthorpe wrote:

If something holds a refcount then it is at risk of UAFing. For abort paths we expect the caller to never share the object with a parallel thread and to clean up any refcounts it obtained on its own.

Add the missing dec inside iommufd_hwpt_paging_alloc()during error unwind by making iommufd_hw_pagetable_attach/detach() proper pairs.

Signed-off-by: Jason Gunthorpe jgg@nvidia.com

Reviewed-by: Nicolin Chen nicolinc@nvidia.com