Re: [BUG] iommu: KASAN slab-use-after-free in iommufd_auto_response_faults

[Peiyang He]

On 2026/7/13 14:10, Tian, Kevin wrote:
>> From: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
>> Sent: Tuesday, July 7, 2026 2:13 PM
>>
>> The analysis above goes through the iommufd selftest mock device (M). We
>> have not reproduced this on real Intel/AMD hardware, but the same lifetime
>> issue is not specific to the mock driver: Intel and AMD both have real detach
>> paths that can reach the very same iopf_queue_remove_device(). This is
>> exactly
>> what iommufd_hwpt_detach_device() triggers, via
>> iommu_detach_group_handle() /
>> iommu_detach_device_pasid(), right before it calls
>> iommufd_auto_response_faults().
> 
> yeah it's certainly a bug - it doesn't make sense to have an object sitting
> on two lists after its ownership is transferred. Suppose we should delete
> the group from iopf queue then add it to the iommufd queue in
> iommufd_fault_iopf_handler().
> 
> Can you help send a fix accordingly?

Hi Kevin,
Thanks for your reply! No problem, I will try sending a patch very soon.

Best,
Peiyang