Re: [PATCH v1 1/4] iommu: Unpublish the attach handle before the group detach callback

[Baolu Lu <baolu.lu@linux.intel.com>]

On 9/30/2026 5:51 AM, Nicolin Chen wrote:
> The group->pasid_array entry is erased only after the detach callback has
> returned, so the outgoing attach handle stays published for the whole of
> that call. iommu_attach_handle_get() reads it under the xa_lock alone, not
> under the group mutex, so a fault raised in the meantime still finds that
> handle and the domain being detached, both of which the caller frees the
> moment that detach returns.
> 
> Commit 5e9f822c9c68 ("iommu: Swap the order of setting group->pasid_array
> and calling attach op of iommu drivers") has fixed the attach path, while
> the detach path never got the symmetric change.
> 
> Erase the entry ahead of the callback instead. A missing entry reads back
> as NULL from xa_load(), so that iommu_attach_handle_get() returns -ENOENT
> and the fault gets rejected rather than delivered against a domain that is
> on its way out.
> 
> Fixes: 8519e689834a ("iommu: Extend domain attach group with handle support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM

This tag is no longer necessary.

> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
> ---
>   drivers/iommu/iommu.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index cd1bca7ede9af..a062a84686c29 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -3951,8 +3951,12 @@ void iommu_detach_group_handle(struct iommu_domain *domain,
>   			       struct iommu_group *group)
>   {
>   	mutex_lock(&group->mutex);
> -	__iommu_group_set_core_domain(group);
> +	/*
> +	 * Unpublish the handle first, so it would not resolve to the detaching
> +	 * domain once the driver is detaching it.
> +	 */
>   	xa_erase(&group->pasid_array, IOMMU_NO_PASID);
> +	__iommu_group_set_core_domain(group);
>   	mutex_unlock(&group->mutex);
>   }
>   EXPORT_SYMBOL_NS_GPL(iommu_detach_group_handle, "IOMMUFD_INTERNAL");

Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>