[PATCH] iommu: iommufd: fix WARNING in iommufd_device_unbind

[Suraj Sonawane]

Fix an issue detected by syzbot:
WARNING in iommufd_device_unbind
iommufd: Time out waiting for iommufd object to become free

Resolve a warning in iommufd_device_unbind caused by a
timeout while waiting for the shortterm_users reference
count to reach zero. The existing 10-second timeout is
insufficient in some scenarios, resulting in failures
and the following warning:

WARNING in iommufd_device_unbind
iommufd: Time out waiting for iommufd object to become free

Increase the timeout in iommufd_object_dec_wait_shortterm
from 10 seconds to 12 seconds (msecs_to_jiffies(12000))
to allow sufficient time for the reference count to drop
to zero. This change prevents premature timeouts and reduces
the likelihood of warnings during iommufd_device_unbind.

The fix has been tested and validated by syzbot. This patch
closes the bug reported at the following syzkaller link.


Reported-by: syzbot+c92878e123785b1fa2db@xxxxxxxxxxxxxxxxxxxxxxxxx 
Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db 
Tested-by: syzbot+c92878e123785b1fa2db@xxxxxxxxxxxxxxxxxxxxxxxxx 
Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object") 
Signed-off-by: Suraj Sonawane <surajsonawane0215@xxxxxxxxx>
---
 drivers/iommu/iommufd/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
index d2683ad82..954c021e9 100644
--- a/drivers/iommu/iommufd/main.c
+++ b/drivers/iommu/iommufd/main.c
@@ -104,7 +104,7 @@ static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
 	if (wait_event_timeout(ictx->destroy_wait,
 				refcount_read(&to_destroy->shortterm_users) ==
 					0,
-				msecs_to_jiffies(10000)))
+				msecs_to_jiffies(12000)))
 		return 0;
 
 	pr_crit("Time out waiting for iommufd object to become free\n");
-- 
2.34.1