Re: [syzbot] [iommu?] KASAN: slab-use-after-free Read in free_iova

Jason Gunthorpe <[email protected]>
Newsgroups dev.linux.lists.iommu,org.kernel.vger.linux-kernel
Message-ID <[email protected]> 
On Tue, Aug 11, 2026 at 01:57:38PM +0100, Robin Murphy wrote:

> But where would that unmap be?

If the theory is right then the bug would be some concurrent driver
thread like a work queue/timer or a user thread going into a fops that
outlives the driver remove function. That thread would do the unmap.

This is an extremely common bug class in drivers at least..

eg DRM has lots of challenges in this area if the guess about VGA is
correct.

Regards,
Jason
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.