Syzkaller found another small issue, a race with iommufd_object_destroy_user() and IOMMUFD_DESTROY.
While researching that I noticed an error unwind mistake by inspection.
Yi and Nicolin stumbled on the last one running the test suite sometimes.
Jason Gunthorpe (3): iommufd/selftest: Do not try to destroy an access once it is attached iommufd: IOMMUFD_DESTROY should not increase the refcount iommufd: Set end correctly when doing batch carry
drivers/iommu/iommufd/device.c | 12 +--- drivers/iommu/iommufd/iommufd_private.h | 15 ++++- drivers/iommu/iommufd/main.c | 78 +++++++++++++++++++------ drivers/iommu/iommufd/pages.c | 2 +- drivers/iommu/iommufd/selftest.c | 9 +-- 5 files changed, 81 insertions(+), 35 deletions(-)
base-commit: 6eaae198076080886b9e7d57f4ae06fa782f90ef