[PATCH] iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

[PATCH] iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

[Peiyang He]

iommufd_hwpt_replace_device() calls:

	iommufd_auto_response_faults(hwpt, old_handle);

passing the *new* hwpt together with the handle of
the device's *old* domain. This should be a parameter mismatch:

1. Semantically, iommufd_auto_response_faults(x, handle) scans
   x->fault's deliver list and response xarray for groups matching
   "handle". A group is queued under the hwpt that was attached at
   fault-delivery time. old_handle is fetched *before* the domain switch,
   so its group lives on old->fault, not on the new hwpt->fault.

2. Historically, the first argument was "old". The routine was
   introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt
   attach/detach/replace") as __fault_domain_replace_dev() in
   fault.c, correctly calling iommufd_auto_response_faults(old, curr).
   Commit fb21b1568ada ("iommufd: Make attach_handle generic than
   fault specific") moved this into iommufd_hwpt_replace_device() in
   device.c and swapped it to "hwpt". This should be a refactor regression,
   not an intentional change.

Fix this by passing "old" instead.

Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Fixes: fb21b1568ada ("iommufd: Make attach_handle generic than fault specific")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
---
 drivers/iommu/iommufd/device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c
index 170a7005f0bc..2895e5370910 100644
--- a/drivers/iommu/iommufd/device.c
+++ b/drivers/iommu/iommufd/device.c
@@ -589,7 +589,7 @@ static int iommufd_hwpt_replace_device(struct iommufd_device *idev,
 	if (rc)
 		goto out_free_handle;
 
-	iommufd_auto_response_faults(hwpt, old_handle);
+	iommufd_auto_response_faults(old, old_handle);
 	kfree(old_handle);
 
 	return 0;

base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
-- 
2.43.0

RE: [PATCH] iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

[Tian, Kevin]

> From: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Sent: Friday, July 10, 2026 8:30 PM
>
> iommufd_hwpt_replace_device() calls:
> 
> 	iommufd_auto_response_faults(hwpt, old_handle);
> 
> passing the *new* hwpt together with the handle of
> the device's *old* domain. This should be a parameter mismatch:
> 
> 1. Semantically, iommufd_auto_response_faults(x, handle) scans
>    x->fault's deliver list and response xarray for groups matching
>    "handle". A group is queued under the hwpt that was attached at
>    fault-delivery time. old_handle is fetched *before* the domain switch,
>    so its group lives on old->fault, not on the new hwpt->fault.
> 
> 2. Historically, the first argument was "old". The routine was
>    introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt
>    attach/detach/replace") as __fault_domain_replace_dev() in
>    fault.c, correctly calling iommufd_auto_response_faults(old, curr).
>    Commit fb21b1568ada ("iommufd: Make attach_handle generic than
>    fault specific") moved this into iommufd_hwpt_replace_device() in
>    device.c and swapped it to "hwpt". This should be a refactor regression,
>    not an intentional change.
> 
> Fix this by passing "old" instead.
> 
> Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>

ditto not required.

> Fixes: fb21b1568ada ("iommufd: Make attach_handle generic than fault
> specific")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

Re: [PATCH] iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

[Jason Gunthorpe]

On Fri, Jul 10, 2026 at 08:29:52PM +0800, Peiyang He wrote:
> iommufd_hwpt_replace_device() calls:
> 
> 	iommufd_auto_response_faults(hwpt, old_handle);
> 
> passing the *new* hwpt together with the handle of
> the device's *old* domain. This should be a parameter mismatch:
> 
> 1. Semantically, iommufd_auto_response_faults(x, handle) scans
>    x->fault's deliver list and response xarray for groups matching
>    "handle". A group is queued under the hwpt that was attached at
>    fault-delivery time. old_handle is fetched *before* the domain switch,
>    so its group lives on old->fault, not on the new hwpt->fault.
> 
> 2. Historically, the first argument was "old". The routine was
>    introduced by commit b7d8833677ba ("iommufd: Fault-capable hwpt
>    attach/detach/replace") as __fault_domain_replace_dev() in
>    fault.c, correctly calling iommufd_auto_response_faults(old, curr).
>    Commit fb21b1568ada ("iommufd: Make attach_handle generic than
>    fault specific") moved this into iommufd_hwpt_replace_device() in
>    device.c and swapped it to "hwpt". This should be a refactor regression,
>    not an intentional change.
> 
> Fix this by passing "old" instead.
> 
> Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Fixes: fb21b1568ada ("iommufd: Make attach_handle generic than fault specific")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> ---
>  drivers/iommu/iommufd/device.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied

Thanks,
Jason