iommu: Remove useless group refcounting
authorJason Gunthorpe <jgg@nvidia.com>
Tue, 22 Aug 2023 16:15:56 +0000 (13:15 -0300)
committerJoerg Roedel <jroedel@suse.de>
Mon, 25 Sep 2023 09:45:28 +0000 (11:45 +0200)
commite946f8e3e62bf05da21a14658f8cb05e2a616260
tree0c89397ef2164f99151d21db51e3965525a15c20
parent4efd98d41ea71835f4d291176ff1fd0a1803dfd5
iommu: Remove useless group refcounting

Several functions obtain the group reference and then release it before
returning. This gives the impression that the refcount is protecting
something for the duration of the function.

In truth all of these functions are called in places that know a device
driver is probed to the device and our locking rules already require
that dev->iommu_group cannot change while a driver is attached to the
struct device.

If this was not the case then this code is already at risk of triggering
UAF as it is racy if the dev->iommu_group is concurrently going to
NULL/free. refcount debugging will throw a WARN if kobject_get() is
called on a 0 refcount object to highlight the bug.

Remove the confusing refcounting and leave behind a comment about the
restriction.

Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/1-v1-c869a95191f2+5e8-iommu_single_grp_jgg@nvidia.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
drivers/iommu/iommu.c