iopt_release_pages() frees the PAL physical list while holding resv but leaves exp_phys pointing to it. Between the reservation unlock and dma_buf_detach(), an invalidation can see that pointer and unmap the same list again.
Clear exp_phys before dropping resv so a later invalidation sees that there is no live PAL mapping. Link: https://lore.kernel.org/r/[email protected]/ Signed-off-by: Karl Mehltretter <[email protected]> --- drivers/iommu/iommufd/pages.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 9e9bc6a1c..76d8803d6 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1674,9 +1674,11 @@ void iopt_release_pages(struct kref *kref) struct dma_buf *dmabuf = pages->dmabuf.attach->dmabuf; dma_resv_lock(dmabuf->resv, NULL); - if (pages->dmabuf.exp_phys) + if (pages->dmabuf.exp_phys) { dma_buf_pal_unmap_phys(pages->dmabuf.attach, pages->dmabuf.exp_phys); + pages->dmabuf.exp_phys = NULL; + } dma_resv_unlock(dmabuf->resv); dma_buf_unpin(pages->dmabuf.attach); -- 2.39.5 (Apple Git-154)
