Hi Linus,

Two UAFs, one was added this merge window.

Thanks,
Jason

The following changes since commit f83ec76bf285bea5727f478a68b894f5543ca76e:

  Linux 6.17-rc6 (2025-09-14 14:21:14 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git tags/for-linus-iommufd

for you to fetch changes up to 43f6bee02196e56720dd68eea847d213c6e69328:

  iommufd/selftest: Update the fail_nth limit (2025-09-19 10:34:49 -0300)

----------------------------------------------------------------
iommufd 6.17 second rc pull

Two user triggerable UAFs:

- Possible race UAF setting up mmaps

- Syzkaller found UAF when erroring an file descriptor creation ioctl due
  to the fput() work queue.

----------------------------------------------------------------
Jason Gunthorpe (4):
      iommufd: Fix refcounting race during mmap
      iommufd: Fix race during abort for file descriptors
      iommufd: WARN if an object is aborted with an elevated refcount
      iommufd/selftest: Update the fail_nth limit

 drivers/iommu/iommufd/device.c                   |  3 +-
 drivers/iommu/iommufd/eventq.c                   |  9 +---
 drivers/iommu/iommufd/iommufd_private.h          |  3 +-
 drivers/iommu/iommufd/main.c                     | 59 ++++++++++++++++++++----
 tools/testing/selftests/iommu/iommufd_fail_nth.c |  2 +-
 5 files changed, 56 insertions(+), 20 deletions(-)