RE: [BUG] iommu: KASAN slab-use-after-free in iommufd_auto_response_faults

[Tian, Kevin]

> From: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> Sent: Tuesday, July 7, 2026 2:13 PM
> 
> The analysis above goes through the iommufd selftest mock device (M). We
> have not reproduced this on real Intel/AMD hardware, but the same lifetime
> issue is not specific to the mock driver: Intel and AMD both have real detach
> paths that can reach the very same iopf_queue_remove_device(). This is
> exactly
> what iommufd_hwpt_detach_device() triggers, via
> iommu_detach_group_handle() /
> iommu_detach_device_pasid(), right before it calls
> iommufd_auto_response_faults().

yeah it's certainly a bug - it doesn't make sense to have an object sitting
on two lists after its ownership is transferred. Suppose we should delete
the group from iopf queue then add it to the iommufd queue in
iommufd_fault_iopf_handler().

Can you help send a fix accordingly?