[PATCH v3 0/2] iommu/iommufd: Fix IOPF group ownership UAF

[Peiyang He]

This series fixes a UAF caused by an IOPF group being owned both by the
generic pending list and IOMMUFD's userspace fault queues:

  1/2 Minimum fix: dequeue accepted groups before IOMMUFD queues them
      for userspace response, then remove the check on list_empty()
      in iopf_group_response().

  2/2 Refactor: make iopf_group_response() free the group as well
      after responding.

Changes in v3:
  - split the v2 patch into a minimum UAF fix and a follow-up cleanup
    (suggested by Kevin)

Changes in v2:
  - simplify the fix by moving group freeing into iopf_group_response()
    (suggested by Kevin)
  - rename iopf_group_take_ownership() to iopf_group_dequeue()
    (suggested by Kevin)
  - drop changes in iommufd_hwpt_replace_device (suggested by Kevin)
  - rebase to 12f16a37f298

Peiyang He (2):
  iommu/iommufd: Fix IOPF group ownership UAF
  iommu: Make iopf_group_response() free groups

 drivers/iommu/io-pgfault.c     | 83 +++++++++++++++++++++-------------
 drivers/iommu/iommu-sva.c      |  1 -
 drivers/iommu/iommufd/eventq.c |  7 +--
 include/linux/iommu.h          | 10 ++--
 4 files changed, 59 insertions(+), 42 deletions(-)


base-commit: 12f16a37f2982028e21919466401179647f603c7
-- 
2.43.0