[PATCH v3 0/5] iommu: Fix attach handle publication ordering

[Nicolin Chen]

Jason pointed out an issue in the attach handle replacing path:
https://lore.kernel.org/linux-iommu/20260923233920.GJ2545495@xxxxxxxxxx/

When an attachment is detached or replaced, the IOMMU core can still leave
the outgoing attach handle published while calling into the driver. A fault
report looks up the handle without the group mutex, so it can find the old
handle after the driver's fault flush and just before the caller frees it.

Patches 1-4 unpublish the outgoing handle before calling into the driver,
for both group and PASID detach and replace operations. Both replace paths
store XA_ZERO_ENTRY to reserve the slot and restore the old entry on error.

This blocks new lookups, but does not retire a fault that already obtained
the old handle. The driver must still synchronize those readers before the
handle is freed.

Patch 5 rejects a same-domain replace in both of the replace APIs. Such a
replace skips the driver callback. So, nothing would ever flush the pending
faults before the caller frees the old handle.

This is on GitHub:
https://github.com/nicolinc/iommufd/commits/fix_iommu_attach_handle-v3

Changelog
v3
 * Add Reviewed-by from Yi
 * Make the use-after-free hazard explicit in the same-domain comments
v2
 https://lore.kernel.org/all/cover.1793602084.git.nicolinc@xxxxxxxxxx/
 * Rebase on v7.4-rc1
 * Drop "Assisted-by: LLM" tags
 * Add Reviewed-by from Kevin, Yi and Baolu
 * New patch: reject a same-domain replace in the attach handle APIs
v1
 https://lore.kernel.org/all/cover.1790718296.git.nicolinc@xxxxxxxxxx/

Nicolin Chen (5):
  iommu: Unpublish the attach handle before the group detach callback
  iommu: Unpublish the attach handle before the PASID detach callback
  iommu: Unpublish the old attach handle before the group replace
    callback
  iommu: Unpublish the old attach handle before the PASID replace
    callback
  iommu: Reject a same-domain replace in the attach handle APIs

 drivers/iommu/iommu.c | 88 +++++++++++++++++++++++++++++++------------
 1 file changed, 63 insertions(+), 25 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0