Re: [BUG] iommufd/selftest: fault injection in iommufd_get_object can trigger a teardown UAF

[Jason Gunthorpe]

On Fri, Jul 10, 2026 at 01:46:55PM +0800, Peiyang He wrote:
> Hello Linux kernel developers and maintainers,
> 
> We found a KMSAN use-after-free in iommu_device_release_dma_owner
> warning when fuzzing IOMMUFD with selftest with Syzkaller.
> 
> After our digging, we believe this UAF has limited impact, but it
> exposes a possible improvement on how fault injection is handled in
> iommufd_device_pre_destroy().
> 
> The root cause for this UAF is that iommufd_device_pre_destroy()
> uses the fault-injectable iommufd_get_object(), causing it to
> mistakenly assume that the vdev destruction has been taken over by
> another thread.  More detailed analysis will be given below.

Yeah, I made a different fix for this than you suggested. See the
patch I'll post..

Thanks,
Jason