RE: [PATCH v1 4/4] iommu: Unpublish the old attach handle before the PASID replace callback

[Tian, Kevin]

> From: Nicolin Chen <nicolinc@xxxxxxxxxx>
> Sent: Wednesday, September 30, 2026 5:52 AM
> 
> Similar to iommu_replace_group_handle(), iommu_replace_device_pasid() has
> the same inert reserve as the group path and the UAF window:
> 
>   core, holding group->mutex          fault path, no group->mutex
>   ==========================          ===========================
> 
>   xa_cmpxchg()                    ,-- old handle stays published
>     no-op, the slot is occupied   |
>   __iommu_set_group_pasid()       |
>     driver attach/detach ops      |
>         iopf_queue_flush_dev()    |
>                                   |   iommu_attach_handle_get()
>                                   |     reads old_handle
>   xa_store(new entry)             `-- window closes
>   mutex_unlock()
>   kfree(old_handle)  [caller]
>                                   UAF: old_handle->domain->iopf_handler()
> 
> Store XA_ZERO_ENTRY outright, just as the group path now does.
> 
> Fixes: 8a9e1e773f60 ("iommu: Introduce a replace API for device pasid")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Nicolin Chen <nicolinc@xxxxxxxxxx>

Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>