Re: [PATCH 4/5] iommufd: fix cleanup when adding memfd folio pins fails

[Lance Yang]

On Thu, Nov 05, 2026 at 02:10:13PM +0100, David Hildenbrand (Arm) wrote:
>folio_add_pins() can fail after memfd_pin_folios() succeeded pinning a
>folio. Upcoming folio refcount limit checks will make this easier to
>trigger.
>
>Let's fix three problems in the error handling:
>
>1. pfn_reader_release_pins() uses the allocated array size instead of the
>   number of folios returned by memfd_pin_folios(). With large folios,
>   cleanup can unpin uninitialized entries. Remember the number of returned
>   folios and use that during cleanup.
>
>2. pin_memfd_pages() returns on failure without releasing the pins acquired
>   by the current call. Release the per-page pins for folios already
>   expanded into the page array, and the single pins for the remaining
>   folios.
>
>3. pfn_reader_next() returns on failure before updating batch_end_index,
>   even if the batch already contains successfully expanded folios. Update
>   it before propagating the error so cleanup releases those pins as well.
>
>Fixes: 92687c793644 ("iommufd: pfn_reader for file mappings")
>Cc: stable@xxxxxxxxxxxxxxx
>Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>---

Nothing jumped out at me, so:

Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>