From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f172.google.com (mail-qk1-f172.google.com [209.85.222.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64FB4446074 for ; Tue, 11 Aug 2026 13:49:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786456208; cv=none; b=SMBcVCSpVLCGx3dcmObxxqHVy+mn/uL2FZcHIg/6YuQRckTu2m5TEg/KBtOwIS3U0AKD/RBBmiVEhM/XSIlrd5RQCwrYr4ILbexw9JJvCk25GRRQ/e6UmTyEvXQQdVNi7R1mLIQygPwdd0GnORVE+ZqXb6HuwS1Xkxmkgn23sqw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786456208; c=relaxed/simple; bh=01U+LqYVImVC/Ue0VBeheMYmOyd8HOqsFdMr4nxw1JU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Z1WYNGepjew/C+zIsW4J+LOwjHdVMC3MtySXj0hlrVxhaV2R9txZdq9u/Dh8C2+OVgJ7d6c3HtNmgmMaD6fIGS8wV4pZqsAfmgGTeVMNUKqFZ0PylWKUNPlQE7NSscK481WEXyY4RjhkZRcNccl+9YOs4F3EF05Xb3hFbVeYNyA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=d9aN3bzg; arc=none smtp.client-ip=209.85.222.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="d9aN3bzg" Received: by mail-qk1-f172.google.com with SMTP id af79cd13be357-92e5c9211d2so244668585a.1 for ; Tue, 11 Aug 2026 06:49:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1786456195; x=1787060995; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=+4KIzCZA+VrHZ+YDvuG8FfScXQL2hTLG1y7Jskg7GmM=; b=d9aN3bzgRBxjtBSsfoDEeFqr6f5+G1wmoyYhIQpendenSxjNqMtOoEzKDFJQ28jPyH tbjvtKhFo9DVhJrm9D2xQY2NlJlNYvZUi/TGnLqg0nSDnUCxpOYKjGi+6OInARk8J7CP LbC9ftfq4exz6Vq+Of/CSkjSa478PQ+BQfm6JkoY/vkqtwiGkDz+2BOAdJB//kWNbmRQ rz7v6NIMEtnB0RBNfrYpxciZ6FqxsukyWyJB+p/B3Rw7YzJOv+hm0S6Nxg6onnkraGxi E0qgxVgXM5hkUEQ4tws7biWLjYqr9rMcsly2zqdfqHerM95gK25B1WXl0PWMjRrrv5Xr Ghmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786456195; x=1787060995; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+4KIzCZA+VrHZ+YDvuG8FfScXQL2hTLG1y7Jskg7GmM=; b=kb56fblhL3OKXzTTdSAWYdEqf76hCQGtTr2pYEBG8AqCmeX+Dkk5FdTdhSZrbaskQa jVcP00yam7Wke3MUchxUm5cj99jvyIM9c7KCh5dVPB2rodD1B596pZJ6YlguZOgrWNYO jTiLlCna6FqMOoxfSWPJMwsVhQMaZjI0WIx5o3SXORDmNXxtD7rY4je+pHQyDzBEN8SB KX8JAn8bDxfz7IIpNdXBJN82gkpEWxp8QOdU4UTK/tYQSseLyKr2i2hwSg/TrOakcqu+ fY5oAaThjb+Es2G714PN+OSW8cq0DcwT91DUE2R8xoHKOwqY591ZnK1tnvQZC05jwRX1 LH6A== X-Forwarded-Encrypted: i=1; AHgh+Rp+MfvzIZIEfO3izwJdqdY0WhyXRG83Y5FFEuyQM+3KRnpdFgvHUtALOd7sZ3Mm7Ee/pABA3VWlsC7f/ps=@vger.kernel.org X-Gm-Message-State: AOJu0YzV7U5ssx4Pr7DfFU5zt2aIBUh42YgFoVZpX30d3A/GptqeYyt8 BfQiowLiq063jXzUMHOD+PfbbP70dP8memvKllAMhBo8aY1EyvK2lTBRZzryFUajJ2g= X-Gm-Gg: AR+sD11vh3edqbF9gSmX4YsjCC05wTdWEI5TbnTae50ZVCyc+wGi52atnS+O6DBb5ho Xjs9f8BEf9sytuUObYQ0DvzU9VQfLoZameJStIg9CYjQ78a2MfvTZeNUraUt1+PQN32eHHhtbRp q0mRnRHuq+Ox7g5ar3qP7RFgI4K80A6YxonIdbAY+X7gR+GC+qt+gMCt2X+XdLR+L7LUtteHI+K GzQcC2b1Y/3wzxG29emky1TBbkmge8RlfSsGQxW6RiHb/gynXDitp8W2t5LCpE633xdSu4ODmh8 6xBg4uats19uCqvp+RAJxESC43c+MZOqkDdm1KI48H6TKF1Tk4JAE8s4KaVusBSaQe4HHVs/90z SQoMgp62N7roBu0LDK0Wh0pvkcVJlveJrghtpDYWnyMVM2Pq1NCdUzHx31GVcgc1VpohxIba0ME KjuEVBOcieEJKTpi70koLTn8AmsGQyCFJB2eCi+w== X-Received: by 2002:a05:622a:c81:b0:51c:d52:6049 with SMTP id d75a77b69052e-52d5860ffffmr33969911cf.28.1786456195117; Tue, 11 Aug 2026 06:49:55 -0700 (PDT) Received: from ziepe.ca ([142.166.156.215]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-52d5763df66sm11828221cf.0.2026.08.11.06.49.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 06:49:54 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wtmrZ-00000002UZj-3U7x; Tue, 11 Aug 2026 10:49:53 -0300 Date: Tue, 11 Aug 2026 10:49:53 -0300 From: Jason Gunthorpe To: Will Deacon Cc: Robin Murphy , syzbot , baolu.lu@linux.intel.com, dwmw2@infradead.org, iommu@lists.linux.dev, joro@8bytes.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [iommu?] KASAN: slab-use-after-free Read in free_iova Message-ID: <20260811134953.GB544626@ziepe.ca> References: <6a7910da.9c11d2ce.289b96.00da.GAE@google.com> <68eebaf3-2427-48c0-93d3-87455ff266fb@arm.com> <20260810173230.GQ200537@ziepe.ca> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Aug 11, 2026 at 10:48:05AM +0100, Will Deacon wrote: > On Mon, Aug 10, 2026 at 02:32:30PM -0300, Jason Gunthorpe wrote: > > On Mon, Aug 10, 2026 at 11:50:28AM +0100, Robin Murphy wrote: > > > > Freed by task 5327: > > > > kasan_save_stack mm/kasan/common.c:57 [inline] > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 > > > > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 > > > > poison_slab_object mm/kasan/common.c:253 [inline] > > > > __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 > > > > kasan_slab_free include/linux/kasan.h:235 [inline] > > > > slab_free_hook mm/slub.c:2677 [inline] > > > > slab_free mm/slub.c:6377 [inline] > > > > kmem_cache_free+0x182/0x650 mm/slub.c:6504 > > > > free_iova_mem drivers/iommu/iova.c:237 [inline] > > > > put_iova_domain+0xcc/0x100 drivers/iommu/iova.c:454 > > > > > > ...except that right in between here we've called iommu_dma_free_fq() which > > > would have already invoked timer_delete_sync() and freed the queue itself. > > > Wut? > > > > I've been feeding syzkaller riddles to the best AI I can get and it is > > surprisingly good.. So, for this it guesses: > > Huh, that's a pretty good idea. Do you just dunk the report in verbatim, > or do you have a cleverly crafted prompt that you're having more success > with? I usually take the email into a file, download any reproducer and just feed it to it. 'Here is a bug description in xyz.txt what could be wrong' and play the lottery. On this one it could understand the http links and it fetched down the console logs and other information from the dashboard on its own (This was GPT Sol 5.6) Even if it isn't right out of the gate it is usually still interesting and points at new things to think about Like this theory about concurrent unmap is a good guess, but there is a big gap between that guess and finding the source of the unmap. Jason