Re: [syzbot] [iommu?] KASAN: slab-use-after-free Read in free_iova

[Jason Gunthorpe]

On Tue, Aug 11, 2026 at 10:48:05AM +0100, Will Deacon wrote:
> On Mon, Aug 10, 2026 at 02:32:30PM -0300, Jason Gunthorpe wrote:
> > On Mon, Aug 10, 2026 at 11:50:28AM +0100, Robin Murphy wrote:
> > > > Freed by task 5327:
> > > >   kasan_save_stack mm/kasan/common.c:57 [inline]
> > > >   kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > >   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
> > > >   poison_slab_object mm/kasan/common.c:253 [inline]
> > > >   __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
> > > >   kasan_slab_free include/linux/kasan.h:235 [inline]
> > > >   slab_free_hook mm/slub.c:2677 [inline]
> > > >   slab_free mm/slub.c:6377 [inline]
> > > >   kmem_cache_free+0x182/0x650 mm/slub.c:6504
> > > >   free_iova_mem drivers/iommu/iova.c:237 [inline]
> > > >   put_iova_domain+0xcc/0x100 drivers/iommu/iova.c:454
> > > 
> > > ...except that right in between here we've called iommu_dma_free_fq() which
> > > would have already invoked timer_delete_sync() and freed the queue itself.
> > > Wut?
> > 
> > I've been feeding syzkaller riddles to the best AI I can get and it is
> > surprisingly good.. So, for this it guesses:
> 
> Huh, that's a pretty good idea. Do you just dunk the report in verbatim,
> or do you have a cleverly crafted prompt that you're having more success
> with?

I usually take the email into a file, download any reproducer and just
feed it to it. 'Here is a bug description in xyz.txt what could be
wrong' and play the lottery. On this one it could understand the http
links and it fetched down the console logs and other information from
the dashboard on its own (This was GPT Sol 5.6)

Even if it isn't right out of the gate it is usually still interesting
and points at new things to think about

Like this theory about concurrent unmap is a good guess, but there is
a big gap between that guess and finding the source of the unmap.

Jason