[PATCH v1 2/3] iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds

[Tian, Kevin]

> From: Nicolin Chen <nicolinc at nvidia.com>
> Sent: Tuesday, June 30, 2026 5:16 AM
> 
> iommufd_vdevice_alloc_ioctl() adds the vDEVICE to the viommu->vdevs
> xarray
> with xa_cmpxchg() before the driver's vdevice_init() op runs. That op is
> where a driver validates the device and may reject it, but the xarray entry
> is already live by then: a concurrent IOMMU_HWPT_INVALIDATE can look it
> up
> with iommufd_viommu_find_dev() and run the driver invalidation path
> against
> a device that vdevice_init() would have refused.
> 
> Reserve the index with xa_insert(): it stores a zero entry that reads back
> as NULL, and returns -EBUSY on a duplicate virt_id. Run vdevice_init() and
> store the vDEVICE pointer only once it succeeds. A failed vdevice_init()
> releases the reservation, so lookups observe the vDEVICE only after it is
> fully initialized and accepted.
> 
> Fixes: ed42eee797ff3 ("iommufd/viommu: Add driver-defined vDEVICE
> support")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Nicolin Chen <nicolinc at nvidia.com>

cc stable

> 
>  	if (viommu->ops && viommu->ops->vdevice_init) {
>  		rc = viommu->ops->vdevice_init(vdev);
>  		if (rc)
> -			goto out_abort;
> +			goto out_release;
>  	}

though correct, this causes an counter-intuitive error unwind
pattern with the following goto jumps to an outer label (out_abort).

It's cleaner to remove the new label by:

		if (rc) {
			xa_release(&viommu->vdevs, virt_id);
			goto out_abort;
		}

otherwise,

Reviewed-by: Kevin Tian <kevin.tian at intel.com>