Hi Linus,

A bunch of fixes for AI found bugs.

Thanks,
Jason

The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32:

  Linux 7.1-rc2 (2026-05-03 14:21:25 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git tags/for-linus-iommufd

for you to fetch changes up to e28bee5b445178390d63f7a93a5a219063c6434e:

  iommu: Avoid copying the user array twice in the full-array copy helper (2026-06-12 10:44:44 -0300)

----------------------------------------------------------------
iommufd v7.2 merge window pull request

All various fixes:

- Typo breaking the veventq uAPI for 32 bit userspace

- Several Sashiko found errors in the veventq and fault fd paths

- Fix incorrect use of dmabuf locks, and possible races with iommufd
  destroy and dmabuf revoke

- Sashiko errors found in the uAPI validation for IOMMU_HWPT_INVALIDATE

----------------------------------------------------------------
Alex Mastro (1):
      iommufd: Clarify IOAS_MAP_FILE dma-buf support

Ankit Soni (1):
      iommufd: Take dma_resv lock before dma_buf_unpin() in release path

Jason Gunthorpe (1):
      iommufd: Destroy the pages content after detaching from dmabuf

Kai Aizen (1):
      iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

Nicolin Chen (14):
      iommufd: Fix data_len byte-count vs element-count mismatch
      iommufd: Move vevent memory allocation outside spinlock
      iommufd: Set veventq_depth upper bound
      iommufd/selftest: Add boundary tests for veventq_depth
      iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
      iommufd: Reject invalid read count in iommufd_veventq_fops_read()
      iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
      iommufd: Reject invalid read count in iommufd_fault_fops_read()
      iommufd: Break the loop on failure in iommufd_fault_fops_read()
      iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
      iommufd/selftest: Cover invalid read counts on vEVENTQ FD
      iommufd: Set upper bounds on cache invalidation entry_num and entry_len
      iommufd/selftest: Add invalidation entry_num and entry_len boundary tests
      iommu: Avoid copying the user array twice in the full-array copy helper

 drivers/iommu/iommufd/driver.c                   | 13 +++---
 drivers/iommu/iommufd/eventq.c                   | 36 ++++++++++++++---
 drivers/iommu/iommufd/hw_pagetable.c             | 11 ++++-
 drivers/iommu/iommufd/iommufd_private.h          |  2 +-
 drivers/iommu/iommufd/pages.c                    | 10 +++--
 include/linux/iommu.h                            |  1 +
 include/uapi/linux/iommufd.h                     | 12 ++++--
 tools/testing/selftests/iommu/iommufd.c          | 51 +++++++++++++++++++++++-
 tools/testing/selftests/iommu/iommufd_fail_nth.c |  2 +-
 tools/testing/selftests/iommu/iommufd_utils.h    | 17 ++++----
 10 files changed, 124 insertions(+), 31 deletions(-)