Re: [PATCH v2 1/4] iommufd: Add iommufd_object_tombstone_user() helper
From: Jason Gunthorpe
Date: Tue Jun 24 2025 - 09:35:38 EST
On Mon, Jun 23, 2025 at 05:49:43PM +0800, Xu Yilun wrote:
> @@ -251,16 +252,30 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
> */
> while (!xa_empty(&ictx->objects)) {
> unsigned int destroyed = 0;
> - unsigned long index;
>
> - xa_for_each(&ictx->objects, index, obj) {
> - if (!refcount_dec_if_one(&obj->users))
> - continue;
I don't think you need all these changes..
xa_for_each will skip the XA_ZERO_ENTRIES because it won't return NULL
xa_empty() will fail, but just remove it.
@@ -288,6 +288,7 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
struct iommufd_sw_msi_map *next;
struct iommufd_sw_msi_map *cur;
struct iommufd_object *obj;
+ bool empty;
/*
* The objects in the xarray form a graph of "users" counts, and we have
@@ -298,11 +299,13 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
* until the entire list is destroyed. If this can't progress then there
* is some bug related to object refcounting.
*/
- while (!xa_empty(&ictx->objects)) {
+ do {
unsigned int destroyed = 0;
unsigned long index;
+ empty = true;
xa_for_each(&ictx->objects, index, obj) {
+ empty = false;
if (!refcount_dec_if_one(&obj->users))
continue;
destroyed++;
@@ -313,8 +316,13 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
/* Bug related to users refcount */
if (WARN_ON(!destroyed))
break;
- }
- WARN_ON(!xa_empty(&ictx->groups));
+ } while (!empty);
+
+ /*
+ * There may be some tombstones left over from
+ * iommufd_object_tombstone_user()
+ */
+ xa_destroy(&ictx->groups);
Jason