Fix an issue detected by syzbot:
WARNING in iommufd_device_unbind
iommufd: Time out waiting for iommufd object to become free

Resolve a warning in iommufd_device_unbind caused by a
timeout while waiting for the shortterm_users reference
count to reach zero. The existing 10-second timeout is
insufficient in some scenarios, resulting in failures
and the following warning:

WARNING in iommufd_device_unbind
iommufd: Time out waiting for iommufd object to become free

Increase the timeout in iommufd_object_dec_wait_shortterm
from 10 seconds to 12 seconds (msecs_to_jiffies(12000))
to allow sufficient time for the reference count to drop
to zero. This change prevents premature timeouts and reduces
the likelihood of warnings during iommufd_device_unbind.

The fix has been tested and validated by syzbot. This patch
closes the bug reported at the following syzkaller link.


Reported-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com 
Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db 
Tested-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com 
Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object") 
Signed-off-by: Suraj Sonawane <surajsonawane0215@gmail.com>
---
 drivers/iommu/iommufd/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
index d2683ad82..954c021e9 100644
--- a/drivers/iommu/iommufd/main.c
+++ b/drivers/iommu/iommufd/main.c
@@ -104,7 +104,7 @@ static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
 	if (wait_event_timeout(ictx->destroy_wait,
 				refcount_read(&to_destroy->shortterm_users) ==
 					0,
-				msecs_to_jiffies(10000)))
+				msecs_to_jiffies(12000)))
 		return 0;
 
 	pr_crit("Time out waiting for iommufd object to become free\n");
-- 
2.34.1

On Sun, Nov 24, 2024 at 01:29:00AM +0530, Suraj Sonawane wrote:
> Fix an issue detected by syzbot:
> WARNING in iommufd_device_unbind
> iommufd: Time out waiting for iommufd object to become free
> 
> Resolve a warning in iommufd_device_unbind caused by a
> timeout while waiting for the shortterm_users reference
> count to reach zero. The existing 10-second timeout is
> insufficient in some scenarios, resulting in failures
> and the following warning:
> 
> WARNING in iommufd_device_unbind
> iommufd: Time out waiting for iommufd object to become free
> 
> Increase the timeout in iommufd_object_dec_wait_shortterm
> from 10 seconds to 12 seconds (msecs_to_jiffies(12000))
> to allow sufficient time for the reference count to drop
> to zero. This change prevents premature timeouts and reduces
> the likelihood of warnings during iommufd_device_unbind.
> 
> The fix has been tested and validated by syzbot. This patch
> closes the bug reported at the following syzkaller link.
> 
> 
> Reported-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com 
> Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db 
> Tested-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com 
> Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object") 
> Signed-off-by: Suraj Sonawane <surajsonawane0215@gmail.com>
> ---
>  drivers/iommu/iommufd/main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

I've taken this but I increased the timeout to 60s, which is similar
to other such timeouts in the kernel

Though I do wonder what syzkaller has done to hit this..

Thanks,
Jason