linux-kernel - [GIT PULL] Please pull IOMMUFD subsystem changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250922143329.GA2529959@nvidia.com>
Date: Mon, 22 Sep 2025 11:33:29 -0300
From: Jason Gunthorpe <jgg@...dia.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: iommu@...ts.linux.dev, kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org, Kevin Tian <kevin.tian@...el.com>
Subject: [GIT PULL] Please pull IOMMUFD subsystem changes

Hi Linus,

Two UAFs, one was added this merge window.

Thanks,
Jason

The following changes since commit f83ec76bf285bea5727f478a68b894f5543ca76e:

  Linux 6.17-rc6 (2025-09-14 14:21:14 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git tags/for-linus-iommufd

for you to fetch changes up to 43f6bee02196e56720dd68eea847d213c6e69328:

  iommufd/selftest: Update the fail_nth limit (2025-09-19 10:34:49 -0300)

----------------------------------------------------------------
iommufd 6.17 second rc pull

Two user triggerable UAFs:

- Possible race UAF setting up mmaps

- Syzkaller found UAF when erroring an file descriptor creation ioctl due
  to the fput() work queue.

----------------------------------------------------------------
Jason Gunthorpe (4):
      iommufd: Fix refcounting race during mmap
      iommufd: Fix race during abort for file descriptors
      iommufd: WARN if an object is aborted with an elevated refcount
      iommufd/selftest: Update the fail_nth limit

 drivers/iommu/iommufd/device.c                   |  3 +-
 drivers/iommu/iommufd/eventq.c                   |  9 +---
 drivers/iommu/iommufd/iommufd_private.h          |  3 +-
 drivers/iommu/iommufd/main.c                     | 59 ++++++++++++++++++++----
 tools/testing/selftests/iommu/iommufd_fail_nth.c |  2 +-
 5 files changed, 56 insertions(+), 20 deletions(-)

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)