Re: [PATCH 1/4] iommu/sva: Set handle->dev before the SVA handle is visible

[Baolu Lu]

On 7/26/26 15:43, Shuai Xue wrote:
> iommu_attach_device_pasid() installs the new SVA attach handle in the
> group PASID lookup before iommu_sva_bind_device() returns. A concurrent
> bind can therefore find and reuse the same handle after iommu_sva_lock is
> dropped.
>
> handle->dev was initialized after dropping iommu_sva_lock. This leaves a
> window where a racing bind can return a handle whose dev pointer is still
> NULL. A subsequent iommu_sva_unbind_device() can then dereference it via
> handle->dev->iommu_group.
>
> Initialize handle->dev before releasing iommu_sva_lock so any visible SVA
> handle is fully initialized.
>
> Fixes: be51b1d6bbff ("iommu/sva: Refactoring iommu_sva_bind/unbind_device()")
> Cc:stable@xxxxxxxxxxxxxxx
> Assisted-by:Qoder:Qwen-3.8-MAX-Preview
> Signed-off-by: Shuai Xue<xueshuai@xxxxxxxxxxxxxxxxx>
> ---
>   drivers/iommu/iommu-sva.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Lu Baolu <baolu.lu@xxxxxxxxxxxxxxx>