RE: [BUG] iommufd/selftest: KASAN slab-use-after-free in iommu_report_device_fault

[Tian, Kevin]

> From: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> Sent: Wednesday, July 22, 2026 5:52 PM
>
[...]
 > Since iommu_attach_handle_get() explicitly says that the caller should be
> responsible for "synchronize the call of iommu_attach_handle_get()
> with domain attachment and detachment", maybe we shouldn't add extra
> lifetime
> management mechanism around iommu_attach_handle, instead we should
> fix this at the caller side.
> 
> Fault report can run concurrently with PASID detach and replacement, but
> before the old attach handle is removed and freed, mockdev must block new
> reports
> for that PASID and wait for in-flight iommu_report_device_fault() calls to
> finish.
> 

yes the mock driver should drain in-flight fault requests before the
actual detachment, just like other iommu drivers do.