From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 22 Sep 2025 18:16:14 +0000 (-0700)
Subject: Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg... 
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=d4c7fccfa784da0583fed9c8f98ed78236c030fb;p=users%2Fhch%2Fmisc.git

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd fixes from Jason Gunthorpe:
 "Fix two user triggerable use-after-free issues:

   - Possible race UAF setting up mmaps

   - Syzkaller found UAF when erroring an file descriptor creation ioctl
     due to the fput() work queue"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd/selftest: Update the fail_nth limit
  iommufd: WARN if an object is aborted with an elevated refcount
  iommufd: Fix race during abort for file descriptors
  iommufd: Fix refcounting race during mmap
---

d4c7fccfa784da0583fed9c8f98ed78236c030fb