Re: [syzbot] [iommu?] KASAN: slab-use-after-free Read in free_iova

[Jason Gunthorpe]

On Tue, Aug 11, 2026 at 01:57:38PM +0100, Robin Murphy wrote:

> But where would that unmap be?

If the theory is right then the bug would be some concurrent driver
thread like a work queue/timer or a user thread going into a fops that
outlives the driver remove function. That thread would do the unmap.

This is an extremely common bug class in drivers at least..

eg DRM has lots of challenges in this area if the guess about VGA is
correct.

Regards,
Jason