Re: [PATCH v3 5/5] iommu: Reject a same-domain replace in the attach handle APIs

[Baolu Lu]

On 11/4/2026 2:07 AM, Nicolin Chen wrote:
> Both iommu_replace_group_handle() and iommu_replace_device_pasid() skip the
> driver callback when the new domain is the one currently attached. In that
> case, nothing flushes the pending faults that may still be holding the old
> handle. Then, the caller frees the old handle once the replace returns, so
> such a fault would hit a use-after-free.
>
> No caller does this today, since iommufd_device_do_replace() returns early
> when the new hwpt is the old one. However, it is only a caller convention,
> which neither API enforces.
>
> Reject a same-domain replace in both APIs with a WARN_ON, and document it
> in their kernel-docs.
>
> Suggested-by: Lu Baolu<baolu.lu@xxxxxxxxxxxxxxx>
> Reviewed-by: Yi Liu<yi.l.liu@xxxxxxxxx>
> Signed-off-by: Nicolin Chen<nicolinc@xxxxxxxxxx>
> ---
>   drivers/iommu/iommu.c | 36 +++++++++++++++++++++++++++++-------
>   1 file changed, 29 insertions(+), 7 deletions(-)

Reviewed-by: Lu Baolu <baolu.lu@xxxxxxxxxxxxxxx>