Re: [PATCH 1/4] iommu/sva: Set handle->dev before the SVA handle is visible

On 7/26/26 15:43, Shuai Xue wrote:
> iommu_attach_device_pasid() installs the new SVA attach handle in the
> group PASID lookup before iommu_sva_bind_device() returns. A concurrent
> bind can therefore find and reuse the same handle after iommu_sva_lock is
> dropped.
> 
> handle->dev was initialized after dropping iommu_sva_lock. This leaves a
> window where a racing bind can return a handle whose dev pointer is still
> NULL. A subsequent iommu_sva_unbind_device() can then dereference it via
> handle->dev->iommu_group.
> 
> Initialize handle->dev before releasing iommu_sva_lock so any visible SVA
> handle is fully initialized.
> 
> Fixes: be51b1d6bbff ("iommu/sva: Refactoring iommu_sva_bind/unbind_device()")
> Cc:[email protected]
> Assisted-by:Qoder:Qwen-3.8-MAX-Preview
> Signed-off-by: Shuai Xue<[email protected]>
> ---
>   drivers/iommu/iommu-sva.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Lu Baolu <[email protected]>