--- x/drivers/iommu/iommufd/iommufd_private.h
+++ y/drivers/iommu/iommufd/iommufd_private.h
@@ -156,8 +156,8 @@ struct iommufd_object *iommufd_get_objec
 					  enum iommufd_object_type type);
 static inline void iommufd_put_object(struct iommufd_object *obj)
 {
-	refcount_dec(&obj->users);
 	up_read(&obj->destroy_rwsem);
+	refcount_dec(&obj->users);
 }
 
 void iommufd_object_abort(struct iommufd_ctx *ictx, struct iommufd_object *obj);