Re: [PATCH v8 02/12] iommu: Introduce a replace API for device pasid

[Baolu Lu <baolu.lu@linux.intel.com>]

On 2/27/25 10:29, Yi Liu wrote:
>>          entry = iommu_make_pasid_array_entry(domain, handle);
>>          curr = xa_cmpxchg(&group->pasid_array, pasid, NULL,
>>                            XA_ZERO_ENTRY, GFP_KERNEL);
>>          if (xa_is_err(curr))
>>                  return xa_err(curr);
>>
>>          /* Not a replace case */
>>          if (!curr) {
>>                  xa_release(&group->pasid_array, pasid);
>>                  return -EINVAL;
>>          }
>>
>>          curr_domain = pasid_array_entry_to_domain(curr);
>>          if (curr_domain == domain)
>>                  return 0;
> 
> even if domains are the same, we cannot assume the handles are the same. If
> not the same, we still need to update the xa_array. Otherwise, UAF of the
> old handle may occur although I don't think current caller does it. Or if
> no old handle, handle needs to be stored.

Okay, fair enough.