[RFC PATCH 3/6] iommufd: Clear the PAL list before dropping resv
From: Karl Mehltretter
Date: Tue Oct 20 2026 - 02:42:32 EST
iopt_release_pages() frees the PAL physical list while holding resv but
leaves exp_phys pointing to it. Between the reservation unlock and
dma_buf_detach(), an invalidation can see that pointer and unmap the same
list again.
Clear exp_phys before dropping resv so a later invalidation sees that
there is no live PAL mapping.
Link: https://lore.kernel.org/r/20261016194022.62065-1-kmehltretter@xxxxxxxxx/
Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
---
drivers/iommu/iommufd/pages.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c
index 9e9bc6a1c..76d8803d6 100644
--- a/drivers/iommu/iommufd/pages.c
+++ b/drivers/iommu/iommufd/pages.c
@@ -1674,9 +1674,11 @@ void iopt_release_pages(struct kref *kref)
struct dma_buf *dmabuf = pages->dmabuf.attach->dmabuf;
dma_resv_lock(dmabuf->resv, NULL);
- if (pages->dmabuf.exp_phys)
+ if (pages->dmabuf.exp_phys) {
dma_buf_pal_unmap_phys(pages->dmabuf.attach,
pages->dmabuf.exp_phys);
+ pages->dmabuf.exp_phys = NULL;
+ }
dma_resv_unlock(dmabuf->resv);
dma_buf_unpin(pages->dmabuf.attach);
--
2.39.5 (Apple Git-154)