From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f178.google.com (mail-qt1-f178.google.com [209.85.160.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C37B14457A5 for ; Tue, 11 Aug 2026 13:12:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786453923; cv=none; b=PjTcQwlfZz5mno2405rGC6zIZB9IIRgFu9AbV1vQHe6a3I1XxuYeu/BGOCM/pl6213PW927iespndJYdjiRwriKlDxIR2OPu5eEBQXA86fDZdGPVBfH18DESle7y4HL+UkyA742Yrm8U2cuzGGTIZEXDT/IG+k1bRPZsmHDHAws= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786453923; c=relaxed/simple; bh=aM15LEyt+A7JAFcZbfqqyzVQoXdDaCRRtEKVlrRcLog=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=r4pDJEP5PEarZTs6YzZnaQgUb/NZmJ9FG22V8XkLEGZrzhpp93Xyhyizjtc8jy2xf2gp4Ov5Bs+PE00Ky83KVn6Yn8Fd68PiUrnLZ6ZQoDXpt5+Jr1tED6tb5cx8A8kG+Pc1+uttnA5hPB8B+USfFf6eAfM3zSb5EtULq0y70mU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=KEbqgifx; arc=none smtp.client-ip=209.85.160.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="KEbqgifx" Received: by mail-qt1-f178.google.com with SMTP id d75a77b69052e-51c0ecfaee7so19836301cf.0 for ; Tue, 11 Aug 2026 06:12:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1786453920; x=1787058720; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=aM15LEyt+A7JAFcZbfqqyzVQoXdDaCRRtEKVlrRcLog=; b=KEbqgifx8fNBdJJ0TEQ4HI2oFKy3DWwoukteG/wnM5t62EtJfGBlLSwrjaIoJPHNka xFuiaJ+a+uLZsO5WcptyBe1Z236rjrqzNG7/iawVgRb8u/IOAyfXz4R/+qYV2keEotTE XJ+yxp2QtgdN/NC+v3XUjjZIZ3fD9Vsgj+ZsQ5BFY/eN5nx0KEVz2SAd7rVI0QwdR71t Nuw8ZLeKZ9XfDSY9zRKXNiO/p7ETqYwYljyx7klgS624b/LRconx7HivU0SNYcJ4VovW pVUa+nD5bAo4nP5QVaIIiebff19wQp3CFg1CuYTC9rYOoUmOHNRtShm1U26SnagDqCSn QcXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786453920; x=1787058720; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=aM15LEyt+A7JAFcZbfqqyzVQoXdDaCRRtEKVlrRcLog=; b=JMapoESDhdHprW/AcsYzbBlKztb3VMS/jxO4Jtw3gqsadF5cdOviEUUWDNXsYVYd5h QS9CRyifNvY9tKcC5HsYnJXqkRTv3GdcEwSjWTBsTcCuYlpej+mcUw6HAiPWF/02TwDE wzkGkov6IW/Vw31sS2qIla1W39XsnSK4GDrXwBn7UL/SaBXsZYU4wk4G1ww4khUESZhb YoOYH9zXLa/ufPdF5mZnMoSpurlj37+TC+4RuY7RQn4doArjf9yLo4QMu+SmEFQcYh5S ibTj90YN+NCtpZqzjdnPHqRI9OkI1/t+d8vOQeVahAJggt1ho4FB58KQyZYRrRrSpZKB g/wg== X-Forwarded-Encrypted: i=1; AHgh+RozPCquWnME+5SRmP1F2p56ujEfol4Z0VROpwbWm3vUKuxQmjYsuBPrgsuH4qsks4plMIfNd0sc1ls1140=@vger.kernel.org X-Gm-Message-State: AOJu0Yxie/RS+dlEGTCEzpUwZQH8CqW+V4F+1pCiiqXG2oqFDWki443R dvIhH66YscvxppOrqaEg3FZ4odqNZVxfvjRb6ITpyFG9hsa+Veauu0nshh1pKcFeJi4= X-Gm-Gg: AR+sD10zYRATV05c5UZYQUTB8+EwCD78ZkETnlmSACVOTUw91ISaellxWXfmYVW1+kf bdlIjJodG9gYKOq3iDvQU5eeYOBbRIZV3xYfr2UP+eEIFiMs3C8gyd8Sl6w8k1B/J6rqfoRX9LT 6NZOfw5frRgI4YX5KdK0f/ka31eQViHi58FWJgxIOR/epUnQlQYlOM0071vAgnkRhmi9M7Lh/DI EZu4Eos1orMeL0dghl0Jfitjn6Dn6UzQT/WebBVh8jY8Hm+vBpecx0nWyVtCqNaJnERf/gjxxTH WGEI6ZOJvgRZCrfgutL0amLJ2f6USQQlCwU9rG2c/6csFpmFHWdOIm3V+VG7rP1yMqtQm3KByuV 11+UnNIn+TK6slX2fqGrm0gZVEIzBSwkX6yQCcjGglLEBnpJc3SYayfX6uGbpbIHMhdNDEMf2JB l0HuDNZ/2Uzq2P4/+xZ96Z64euIMjGcWl8AbDWHw== X-Received: by 2002:ac8:7d53:0:b0:51c:9193:fd9e with SMTP id d75a77b69052e-52d58507bedmr24595901cf.15.1786453920333; Tue, 11 Aug 2026 06:12:00 -0700 (PDT) Received: from ziepe.ca ([142.166.156.215]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90a6646ee92sm9764246d6.8.2026.08.11.06.11.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 06:11:56 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wtmGo-00000002TA5-3uJO; Tue, 11 Aug 2026 10:11:54 -0300 Date: Tue, 11 Aug 2026 10:11:54 -0300 From: Jason Gunthorpe To: Robin Murphy Cc: syzbot , baolu.lu@linux.intel.com, dwmw2@infradead.org, iommu@lists.linux.dev, joro@8bytes.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, will@kernel.org Subject: Re: [syzbot] [iommu?] KASAN: slab-use-after-free Read in free_iova Message-ID: <20260811131154.GA544626@ziepe.ca> References: <6a7910da.9c11d2ce.289b96.00da.GAE@google.com> <68eebaf3-2427-48c0-93d3-87455ff266fb@arm.com> <20260810173230.GQ200537@ziepe.ca> <6f650cc2-b4fd-4305-b4d7-847ef935449a@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6f650cc2-b4fd-4305-b4d7-847ef935449a@arm.com> On Tue, Aug 11, 2026 at 01:57:38PM +0100, Robin Murphy wrote: > But where would that unmap be? If the theory is right then the bug would be some concurrent driver thread like a work queue/timer or a user thread going into a fops that outlives the driver remove function. That thread would do the unmap. This is an extremely common bug class in drivers at least.. eg DRM has lots of challenges in this area if the guess about VGA is correct. Regards, Jason