Re: [PATCH v2 5/5] iommu: Reject a same-domain replace in the attach handle APIs

[Nicolin Chen <nicolinc@nvidia.com>]

On Tue, Nov 03, 2026 at 07:59:52PM +0800, Yi Liu wrote:
> On 11/2/26 15:04, Nicolin Chen wrote:
> > @@ -3716,6 +3716,10 @@ EXPORT_SYMBOL_GPL(iommu_attach_device_pasid);
> >    * Caller should always provide a new handle to avoid race with the paths
> >    * that have lockless reference to handle if it intends to pass a valid handle.
> >    *
> > + * The @domain must not be the domain currently attached to the @pasid. Such a
> > + * same-domain replace would skip the driver callback flushing pending faults.
> > + * Then, those faults could use the old handle after the caller frees it.
> > + *
> 
> 
> Not a native speaker, but this reads a bit ambiguous to me:
> 
> I parsed the last sentence as describing intended/acceptable behavior
> rather than the hazard being guarded against - "Then, ... could use"
> reads like a neutral continuation rather than a warning. Might be worth
> making the use-after-free explicit, e.g.:
> 
> A same-domain replace would skip the driver callback that flushes
> pending faults - this is a use-after-free hazard: a fault still holding
> the old handle could dereference it after the caller frees it.

OK. I will respin a v3.

Nicolin