Re: [PATCH v2] Fixes a race in iopt_unmap_iova_range

Sina Hassani
2026-04-07T01:17:36Z

On Mon, Apr 6, 2026 at 6:12 PM Jason Gunthorpe <jgg@ziepe.ca> wrote:
>
> On Mon, Apr 06, 2026 at 04:07:01PM -0700, Sina Hassani wrote:
>
> > io_pagetable *iopt, unsigned long start,
> > unmapped_bytes += area_last - area_first + 1;
> >
> > down_write(&iopt->iova_rwsem);
> > +
> > + /* Do not reconsider things already unmapped in case of
> > + * concurrent allocation */
> > + start = area_last + 1;
>
> area_last can be ULONG_MAX so this literally overflows to 0. It is why
> I formed the suggestion I gave as I did
>
Yes, in which case the if (start < area_last) that follows will catch
it. Are you suggesting I compare against ULONG_MAX instead?
> Jason