Re: [PATCH v2] Fixes a race in iopt_unmap_iova_range

Jason Gunthorpe
2026-04-07T01:12:12Z

On Mon, Apr 06, 2026 at 04:07:01PM -0700, Sina Hassani wrote:

> io_pagetable *iopt, unsigned long start,
> unmapped_bytes += area_last - area_first + 1;
>
> down_write(&iopt->iova_rwsem);
> +
> + /* Do not reconsider things already unmapped in case of
> + * concurrent allocation */
> + start = area_last + 1;

area_last can be ULONG_MAX so this literally overflows to 0. It is why
I formed the suggestion I gave as I did

Jason