Re: [PATCH v3 0/2] iommu/iommufd: Fix IOPF group ownership UAF

[Jason Gunthorpe]

On Sun, Jul 26, 2026 at 01:43:55PM +0100, Will Deacon wrote:
> On Mon, Jul 20, 2026 at 04:50:15PM +0800, Peiyang He wrote:
> > This series fixes a UAF caused by an IOPF group being owned both by the
> > generic pending list and IOMMUFD's userspace fault queues:
> > 
> >   1/2 Minimum fix: dequeue accepted groups before IOMMUFD queues them
> >       for userspace response, then remove the check on list_empty()
> >       in iopf_group_response().
> > 
> >   2/2 Refactor: make iopf_group_response() free the group as well
> >       after responding.
> > 
> > Changes in v3:
> >   - split the v2 patch into a minimum UAF fix and a follow-up cleanup
> >     (suggested by Kevin)
> 
> Oops, I lost track of this as all the versions of the patches are in the
> same thread. Please try to avoid that, as it makes it hard to track in
> an email client and can also confuse tools such as b4.
> 
> Anyway, it looks like v3 is ready to go. Jason, is this something you
> are planning to pick up or shall we take it via the IOMMU tree? It looks
> like patch 1 should go in for -rc.

Yeah I have a bunch of iommufd thing for rc I'l pick it

Thanks,
Jason