Re: [PATCH] iommu: iommufd: fix WARNING in iommufd_device_unbind

[Jason Gunthorpe]

On Sun, Nov 24, 2024 at 01:29:00AM +0530, Suraj Sonawane wrote:
> Fix an issue detected by syzbot:
> WARNING in iommufd_device_unbind
> iommufd: Time out waiting for iommufd object to become free
> 
> Resolve a warning in iommufd_device_unbind caused by a
> timeout while waiting for the shortterm_users reference
> count to reach zero. The existing 10-second timeout is
> insufficient in some scenarios, resulting in failures
> and the following warning:
> 
> WARNING in iommufd_device_unbind
> iommufd: Time out waiting for iommufd object to become free
> 
> Increase the timeout in iommufd_object_dec_wait_shortterm
> from 10 seconds to 12 seconds (msecs_to_jiffies(12000))
> to allow sufficient time for the reference count to drop
> to zero. This change prevents premature timeouts and reduces
> the likelihood of warnings during iommufd_device_unbind.
> 
> The fix has been tested and validated by syzbot. This patch
> closes the bug reported at the following syzkaller link.
> 
> 
> Reported-by: syzbot+c92878e123785b1fa2db@xxxxxxxxxxxxxxxxxxxxxxxxx 
> Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db 
> Tested-by: syzbot+c92878e123785b1fa2db@xxxxxxxxxxxxxxxxxxxxxxxxx 
> Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object") 
> Signed-off-by: Suraj Sonawane <surajsonawane0215@xxxxxxxxx>
> ---
>  drivers/iommu/iommufd/main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

I've taken this but I increased the timeout to 60s, which is similar
to other such timeouts in the kernel

Though I do wonder what syzkaller has done to hit this..

Thanks,
Jason