iommufd: Use iommufd_access_change_ioas in iommufd_access_destroy_object
authorNicolin Chen <nicolinc@nvidia.com>
Fri, 28 Jul 2023 06:33:26 +0000 (23:33 -0700)
committerJason Gunthorpe <jgg@nvidia.com>
Fri, 28 Jul 2023 16:31:24 +0000 (13:31 -0300)
commit6129b59fcdf374b5d82e1f4518884da13de38b1a
treeca5b776d4d4cc09599730a79a07d751be4ca708d
parent9227da7816dd1a42e20d41e2244cb63c205477ca
iommufd: Use iommufd_access_change_ioas in iommufd_access_destroy_object

Update iommufd_access_destroy_object() to call the new
iommufd_access_change_ioas() helper.

It is impossible to legitimately race iommufd_access_destroy_object() with
iommufd_access_change_ioas() as iommufd_access_destroy_object() is only
called once the refcount reache zero, so any concurrent
iommufd_access_change_ioas() is already UAFing the memory.

Link: https://lore.kernel.org/r/f9fbeca2cde7f8515da18d689b3e02a6a40a5e14.1690523699.git.nicolinc@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/iommu/iommufd/device.c