Re: [PATCH v3 0/2] iommu/iommufd: Fix IOPF group ownership UAF

[Will Deacon]

On Mon, Jul 20, 2026 at 04:50:15PM +0800, Peiyang He wrote:
> This series fixes a UAF caused by an IOPF group being owned both by the
> generic pending list and IOMMUFD's userspace fault queues:
> 
>   1/2 Minimum fix: dequeue accepted groups before IOMMUFD queues them
>       for userspace response, then remove the check on list_empty()
>       in iopf_group_response().
> 
>   2/2 Refactor: make iopf_group_response() free the group as well
>       after responding.
> 
> Changes in v3:
>   - split the v2 patch into a minimum UAF fix and a follow-up cleanup
>     (suggested by Kevin)

Oops, I lost track of this as all the versions of the patches are in the
same thread. Please try to avoid that, as it makes it hard to track in
an email client and can also confuse tools such as b4.

Anyway, it looks like v3 is ready to go. Jason, is this something you
are planning to pick up or shall we take it via the IOMMU tree? It looks
like patch 1 should go in for -rc.

Will