Re: [PATCH v1 4/4] iommu: Unpublish the old attach handle before the PASID replace callback

[Baolu Lu]

On 9/30/2026 5:51 AM, Nicolin Chen wrote:
> Similar to iommu_replace_group_handle(), iommu_replace_device_pasid() has
> the same inert reserve as the group path and the UAF window:
>
>    core, holding group->mutex          fault path, no group->mutex
>    ==========================          ===========================
>
>    xa_cmpxchg()                    ,-- old handle stays published
>      no-op, the slot is occupied   |
>    __iommu_set_group_pasid()       |
>      driver attach/detach ops      |
>          iopf_queue_flush_dev()    |
>                                    |   iommu_attach_handle_get()
>                                    |     reads old_handle
>    xa_store(new entry)             `-- window closes
>    mutex_unlock()
>    kfree(old_handle)  [caller]
>                                    UAF: old_handle->domain->iopf_handler()
>
> Store XA_ZERO_ENTRY outright, just as the group path now does.
>
> Fixes: 8a9e1e773f60 ("iommu: Introduce a replace API for device pasid")
> Cc:stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Nicolin Chen<nicolinc@xxxxxxxxxx>
> ---
>   drivers/iommu/iommu.c | 19 ++++++++++++-------
>   1 file changed, 12 insertions(+), 7 deletions(-)

Reviewed-by: Lu Baolu <baolu.lu@xxxxxxxxxxxxxxx>