Re: [syzbot] [iommu?] KASAN: slab-use-after-free Read in free_iova

[Will Deacon]

On Mon, Aug 10, 2026 at 02:32:30PM -0300, Jason Gunthorpe wrote:
> On Mon, Aug 10, 2026 at 11:50:28AM +0100, Robin Murphy wrote:
> > > Freed by task 5327:
> > >   kasan_save_stack mm/kasan/common.c:57 [inline]
> > >   kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > >   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
> > >   poison_slab_object mm/kasan/common.c:253 [inline]
> > >   __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
> > >   kasan_slab_free include/linux/kasan.h:235 [inline]
> > >   slab_free_hook mm/slub.c:2677 [inline]
> > >   slab_free mm/slub.c:6377 [inline]
> > >   kmem_cache_free+0x182/0x650 mm/slub.c:6504
> > >   free_iova_mem drivers/iommu/iova.c:237 [inline]
> > >   put_iova_domain+0xcc/0x100 drivers/iommu/iova.c:454
> > 
> > ...except that right in between here we've called iommu_dma_free_fq() which
> > would have already invoked timer_delete_sync() and freed the queue itself.
> > Wut?
> 
> I've been feeding syzkaller riddles to the best AI I can get and it is
> surprisingly good.. So, for this it guesses:

Huh, that's a pretty good idea. Do you just dunk the report in verbatim,
or do you have a cleverly crafted prompt that you're having more success
with?

Will