Syzkaller found another small issue, a race with iommufd_object_destroy_user() and IOMMUFD_DESTROY. While researching that I noticed an error unwind mistake by inspection. Yi and Nicolin stumbled on the last one running the test suite sometimes. Jason Gunthorpe (3): iommufd/selftest: Do not try to destroy an access once it is attached iommufd: IOMMUFD_DESTROY should not increase the refcount iommufd: Set end correctly when doing batch carry drivers/iommu/iommufd/device.c | 12 +--- drivers/iommu/iommufd/iommufd_private.h | 15 ++++- drivers/iommu/iommufd/main.c | 78 +++++++++++++++++++------ drivers/iommu/iommufd/pages.c | 2 +- drivers/iommu/iommufd/selftest.c | 9 +-- 5 files changed, 81 insertions(+), 35 deletions(-) base-commit: 6eaae198076080886b9e7d57f4ae06fa782f90ef -- 2.41.0
