[RFC PATCH 4/6] iommufd: Keep the pages mutex alive until DMA-buf detach

[Karl Mehltretter]

iopt_release_pages() destroys pages->mutex before removing the DMA-buf
attachment. The linked attachment still exposes pages through
importer_priv. An invalidation can enter iopt_revoke_notify() and lock
the destroyed mutex, including when exp_phys is already NULL.

Destroy pages->mutex after dma_buf_detach() has removed the attachment
and excluded further invalidation callbacks.

Signed-off-by: Karl Mehltretter <kmehltret...@gmail.com>
---
 drivers/iommu/iommufd/pages.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c
index 76d8803d6..59ee68a1a 100644
--- a/drivers/iommu/iommufd/pages.c
+++ b/drivers/iommu/iommufd/pages.c
@@ -1667,7 +1667,6 @@ void iopt_release_pages(struct kref *kref)
        WARN_ON(pages->npinned);
        WARN_ON(!xa_empty(&pages->pinned_pfns));
        mmdrop(pages->source_mm);
-       mutex_destroy(&pages->mutex);
        put_task_struct(pages->source_task);
        free_uid(pages->source_user);
        if (iopt_is_dmabuf(pages) && pages->dmabuf.attach) {
@@ -1689,6 +1688,7 @@ void iopt_release_pages(struct kref *kref)
        } else if (pages->type == IOPT_ADDRESS_FILE) {
                fput(pages->file);
        }
+       mutex_destroy(&pages->mutex);
        kfree(pages);
 }
 
-- 
2.39.5 (Apple Git-154)