RE: [PATCH v1 1/4] iommu: Unpublish the attach handle before the group detach callback

[Tian, Kevin]

> From: Nicolin Chen <nicolinc@xxxxxxxxxx>
> Sent: Wednesday, September 30, 2026 5:52 AM
> 
> The group->pasid_array entry is erased only after the detach callback has
> returned, so the outgoing attach handle stays published for the whole of
> that call. iommu_attach_handle_get() reads it under the xa_lock alone, not
> under the group mutex, so a fault raised in the meantime still finds that
> handle and the domain being detached, both of which the caller frees the
> moment that detach returns.
> 
> Commit 5e9f822c9c68 ("iommu: Swap the order of setting group->pasid_array
> and calling attach op of iommu drivers") has fixed the attach path, while
> the detach path never got the symmetric change.
> 
> Erase the entry ahead of the callback instead. A missing entry reads back
> as NULL from xa_load(), so that iommu_attach_handle_get() returns -ENOENT
> and the fault gets rejected rather than delivered against a domain that is
> on its way out.
> 
> Fixes: 8519e689834a ("iommu: Extend domain attach group with handle
> support")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Nicolin Chen <nicolinc@xxxxxxxxxx>

Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>