From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu, 30 Jul 2026 22:12:31 +0000 (-0700)
Subject: Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e05b559f9cda350d0ab33c44a8c1151ca62d2875;p=thirdparty%2Flinux.git

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd fixes from Jason Gunthorpe:
 "Several bug fixes found by tools and fuzzing:

   - Incorrect domain passed during replace to ack faults

   - Block the access API from using dmabuf

   - Missing unlock on error unwind

   - Race seeing a partially setup vdevice in the xarray

   - Do not allow vdevices to have multiple stream ids in SMMUv3

   - Possible UAF if racing faults with domain changes"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommu/iommufd: Fix IOPF group ownership UAF
  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
  iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
  iommufd/viommu: Release the igroup lock on the vdevice_size error path
  iommufd: Reject DMABUF pages from the access pin path
  iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
---

e05b559f9cda350d0ab33c44a8c1151ca62d2875