[GIT PULL] Please pull IOMMUFD subsystem changes

[Jason Gunthorpe]

Hi Linus,

Collection of bugs for iommufd. It seems there has been some
additional bug detections by a non-Google syzkaller, along with some
AI stuff.

Thanks,
Jason

The following changes since commit a13c140cc289c0b7b3770bce5b3ad42ab35074aa:

  Linux 7.2-rc3 (2026-07-12 14:16:39 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git tags/for-linus-iommufd

for you to fetch changes up to 738e6f32e61d80b554e37015ecb7bc620b88001c:

  iommu/iommufd: Fix IOPF group ownership UAF (2026-07-26 13:16:21 -0300)

----------------------------------------------------------------
iommufd v7.2 first rc pull request

Several bug fixes found by tools and fuzzing:

- Incorrect domain passed during replace to ack faults

- Block the access API from using dmabuf

- Missing unlock on error unwind

- Race seeing a partially setup vdevice in the xarray

- Do not allow vdevices to have multiple stream ids in SMMUv3

- Possible UAF if racing faults with domain changes

----------------------------------------------------------------
Nicolin Chen (3):
      iommufd/viommu: Release the igroup lock on the vdevice_size error path
      iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
      iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

Peiyang He (3):
      iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
      iommufd: Reject DMABUF pages from the access pin path
      iommu/iommufd: Fix IOPF group ownership UAF

 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c    | 15 ++++++++++++++
 drivers/iommu/io-pgfault.c                         | 24 +++++++++++++++++-----
 drivers/iommu/iommufd/device.c                     |  2 +-
 drivers/iommu/iommufd/eventq.c                     |  2 ++
 drivers/iommu/iommufd/pages.c                      |  3 +++
 drivers/iommu/iommufd/viommu.c                     | 22 ++++++++++++++------
 include/linux/iommu.h                              |  5 +++++
 7 files changed, 61 insertions(+), 12 deletions(-)

Attachment: signature.asc
Description: PGP signature