From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f174.google.com (mail-qt1-f174.google.com [209.85.160.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5F77346ADE for ; Mon, 13 Jul 2026 17:23:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963420; cv=none; b=BabRJtn88BXV+CUVLHfC1CAZX598DXpBwA44XCbCLNbXamy+HTqfL6UfmiQlTd5zpfSteS4B8PhzeTTqSQV4cSifLZaiaTJu7qMyujy1NX/PB9az4rPTU87rD9H8THQjnIq8eh64H8czMNo9qKb+egi3rbOK7RMp+7DLuIKDtJk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963420; c=relaxed/simple; bh=wxEdqGJIuwK7FxHMypKlsv3XOm1Q2G8Mhu9SSr2IMQs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=kFf0dVQCtXf7VrUs2x/QmKhrgo6UKDfICm01aqqbC4DR0qMNA0aFAhKBChE9nwDdMgA1YuhkporgtcCtscAAZh3EOpvOdowiskiFUECPjqZ7PbzpOJ58H/WWf+6pfNowpVd2D51SN+w2bkh0lGji2UPGbBjF6DgwimUid0k/ajc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=A6p8ipIa; arc=none smtp.client-ip=209.85.160.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="A6p8ipIa" Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-51bfa429aa6so903651cf.0 for ; Mon, 13 Jul 2026 10:23:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1783963418; x=1784568218; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=uuXth6kM41aD+brEyw7ekEydi1QKQ14BXBpZiPQW7/0=; b=A6p8ipIaePvD0E6mFB/Dpimh0IBtWvaF2fix5lJQTMc/AhS5cHtiGqr07BIfAWjCNB iC7NG70WgDJhjklCCV8kyTg63/6qCCTWmAMPGWvRRyD7jG2+DMDKBdkrwScSgpw/y6bv KoszTHjzoafefi7UtGbUK3U+i4hssuYYLyMC05rBKjDbWEfSTh5q/R6s6LujgUfkTrVC xxPMMCxdCxbf5TCVjH6zALhwceeKd71n364xxgzhitDuVegd2FOi9Lvt0tpya3JgpKQh uSMQqmnZbEErEAsdaKAO8WEB+mAgYv6/lK61N5jmqYaA8gPxplCKj5M/NYhmmnjoygHt 7/+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783963418; x=1784568218; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=uuXth6kM41aD+brEyw7ekEydi1QKQ14BXBpZiPQW7/0=; b=rv+iwN5sH/FbaVA1Y5r8UOC77io8d0JklaYRmvatjfhX5xEW/dmGRncXHAZke6EWaL uwojruLF0uwDSWaxTwZCg1EPQ29MC0153XdSUSL71YJ1VxzEKJytDozcZpzfSQaa/1vq BJNcqog2Ms5zmXFtEdfXVb8LpmLzFxPjg4JU4ce20rLWLZQr48PfPWDIKJlqZTgFcGJ4 qpagGGh9T2HfXRYlBChBsQjL7FkoecS73hVaS8Lq5oW+PEzm94Hy+0efg1hld7RpLd8S ObaB4TG8cg86yZkXZousTbafbyF3dfqcW4TkaVCS4+HtP/QHGsxott7yBRgIprYrg8OC 7R6Q== X-Forwarded-Encrypted: i=1; AHgh+Rpirw+atzjcuSszvGkHYJc5XI6UcsOTP2HriMfTeBuLYe7RJu0R5L8X9Ek3EdC0WFV5TcfAWB++iIQkD8c=@vger.kernel.org X-Gm-Message-State: AOJu0Yz8I5+4hJfVjteKuhtxvRn5GzNAuOU4m12jt17ZUHAnhPp3rCjc +MYS1wLrwu34dgQ5HH8iTi8TkevWPxNWu007l9lBxPjdS7DhdXgFRP2OEjb+1AoK+W8= X-Gm-Gg: AfdE7cnG5YGFeid2MDHo/zzv5k72dIW4HL3NVkIqfd8IBT2XxXmhYiH2W4gv3tt8W4w BG7Ma0YIGX1Wc+j3OHCx+QruurSoGODF0G97mtJX4F5qdtU/3XUlcnRqzufS9Y4j8u68weDf0iK 0Ewf9kb0fR/ItvrB9Mvty+AyVDfnFDLlEzMR1nM5Wy6dKU/owFuMKEDd/4Njz8aIUzL38iQhzmo +FMxgH0SxE4/T4Wcp2V5qcKSVeXFHoFUF8OzFim/Q3S+KF6xnbJChC+FT2KCPyzIsLScqhBFIQw ALQWTy40PJCBKu+tiORM5CN6NsZ1Y2KZdP+/lDHC4q1CE1NN+yPp+zwTnq4Q4coAJaT2OwVlocG R/4KZspvVGsffRcbiUylPzdHHjPQuAPO57ITjdczhxjvpuLrRJxoctnOsia0W X-Received: by 2002:ac8:5850:0:b0:51c:7aa7:e0ed with SMTP id d75a77b69052e-51cbfae7cc2mr97664661cf.42.1783963417634; Mon, 13 Jul 2026 10:23:37 -0700 (PDT) Received: from ziepe.ca ([159.2.72.92]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51caab6e9f4sm89206921cf.2.2026.07.13.10.23.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 10:23:37 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wjKNU-0000000Dlr8-09oi; Mon, 13 Jul 2026 14:23:36 -0300 Date: Mon, 13 Jul 2026 14:23:36 -0300 From: Jason Gunthorpe To: Peiyang He Cc: kevin.tian@intel.com, joro@8bytes.org, will@kernel.org, robin.murphy@arm.com, iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [BUG] iommufd/selftest: fault injection in iommufd_get_object can trigger a teardown UAF Message-ID: <20260713172336.GF3133966@ziepe.ca> References: <870BB9ADBBEDDD1A+37c5bfab-ad32-4fc5-a302-57c81a8432b5@smail.nju.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <870BB9ADBBEDDD1A+37c5bfab-ad32-4fc5-a302-57c81a8432b5@smail.nju.edu.cn> On Fri, Jul 10, 2026 at 01:46:55PM +0800, Peiyang He wrote: > Hello Linux kernel developers and maintainers, > > We found a KMSAN use-after-free in iommu_device_release_dma_owner > warning when fuzzing IOMMUFD with selftest with Syzkaller. > > After our digging, we believe this UAF has limited impact, but it > exposes a possible improvement on how fault injection is handled in > iommufd_device_pre_destroy(). > > The root cause for this UAF is that iommufd_device_pre_destroy() > uses the fault-injectable iommufd_get_object(), causing it to > mistakenly assume that the vdev destruction has been taken over by > another thread. More detailed analysis will be given below. Yeah, I made a different fix for this than you suggested. See the patch I'll post.. Thanks, Jason