iommu: iommufd: fix WARNING in iommufd_device_unbind

JIRA: https://issues.redhat.com/browse/RHEL-75942

commit d9df72c
Author: Suraj Sonawane <surajsonawane0215@gmail.com>
Date:   Sun Nov 24 01:29:00 2024 +0530

    iommu: iommufd: fix WARNING in iommufd_device_unbind

    Fix an issue detected by syzbot:

    WARNING in iommufd_device_unbind iommufd: Time out waiting for iommufd object to become free

    Resolve a warning in iommufd_device_unbind caused by a timeout while
    waiting for the shortterm_users reference count to reach zero. The
    existing 10-second timeout is insufficient in some scenarios, resulting in
    failures the above warning.

    Increase the timeout in iommufd_object_dec_wait_shortterm from 10 seconds
    to 60 seconds to allow sufficient time for the reference count to drop to
    zero. This change prevents premature timeouts and reduces the likelihood
    of warnings during iommufd_device_unbind.

    Fixes: 6f9c4d8 ("iommufd: Do not UAF during iommufd_put_object()")
    Link: https://patch.msgid.link/r/20241123195900.3176-1-surajsonawane0215@gmail.com
    Reported-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db
    Tested-by: syzbot+c92878e123785b1fa2db@syzkaller.appspotmail.com
    Signed-off-by: Suraj Sonawane <surajsonawane0215@gmail.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Signed-off-by: Eder Zulian <ezulian@redhat.com>

Author: efzrh

drivers/iommu/iommufd/main.c

@@ -130,7 +130,7 @@ static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
 	if (wait_event_timeout(ictx->destroy_wait,
 				refcount_read(&to_destroy->shortterm_users) ==
 					0,
-				msecs_to_jiffies(10000)))
+				msecs_to_jiffies(60000)))
 		return 0;
 
 	pr_crit("Time out waiting for iommufd object to become free\n");