On Tue, Feb 17, 2026 at 08:11:54PM -0400, Jason Gunthorpe wrote: > + dma_resv_lock(dmabuf->resv, NULL); > + if (pages->dmabuf.exp_phys) > + dma_buf_pal_unmap_phys(pages->dmabuf.attach, > + pages->dmabuf.exp_phys); > + dma_resv_unlock(dmabuf->resv); > + > dma_buf_detach(dmabuf, pages->dmabuf.attach);
exp_phys remains non-NULL after dma_buf_pal_unmap_phys() frees it. A move notification after dma_resv_unlock() and before dma_buf_detach() therefore reaches iopt_revoke_notify() and frees it again. A test hook forced that ordering on the posted series. The one-page IOMMUFD selftest unmap on arm64 QEMU with KASAN reports: BUG: KASAN: double-free in iommufd_dma_pal_unmap_phys+0x14/0x20 The first free is in iopt_release_pages(). The second is through dma_buf_move_notify() -> iopt_revoke_notify(). Clearing exp_phys before dropping the reservation lock makes the same test complete without a KASAN report. Karl
