From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 249513D0907 for ; Sun, 26 Jul 2026 16:15:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785082538; cv=none; b=fVTwjaFw50cBJ28ZkoTu2RMw+542mabSXuJJrCTk13YHyxChfqqudnMSP4jxcsNLp+5KNzMYFAe+t8GkRTx+Sg9yaO2wSKTn0sPAHlT4GwLU+lNunqdQk8uFthcm3wBnmioddG/hlWbwSeUEpMeogJXYNSopeoHS6bPl0LqINP8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785082538; c=relaxed/simple; bh=6CYHJlxkNTZfdOatQqSstuMCIp+AJa4DKfe/htlVSzs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=MxVmL7iKzeEGInNF/V0JWgkY1AZ1u8ZkBlZFKCU6bMHvNtkHSimSv2ygjouniqWUxZgxOnhdn+XvifH09tYs7mYc1+11a3DC+SLqZLTh5JevYjq5uvQlABgcVCijty3exEWW1FwcuqD6YHoyaKrcNTp382ioJiLEyrO23JfkMjg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=gY337+YB; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="gY337+YB" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so24375215ad.1 for ; Sun, 26 Jul 2026 09:15:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1785082518; x=1785687318; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=bagmeEHehug/GOrhos1Z3fTBlBFSZT78kPrPQp6rhbY=; b=gY337+YBglHjeDG5IQiNyAIMWSkCCHZGVFiw5u7rEJalVSBV4o1xHciMdxl+uaFK6m nskRGyegSS6eWFavtiJ6rMEjQEi/rP8vxgogbQk0IZnBNBGdjNPuGppZCFQUVx3x8AtU 68LD5rP+ElFBhjcKNDDbc2aEpf/fdmiqEOzD8oqi+pw/yFDz95xxrcfn7sRd9dLXp0cs 4HhDCzMhNbWWeypnDsbjEbrSeRrybcIw9SjRgWPkX8bwojBukyXl89aSeUx2b/GqqiID PrFcKwxY4ppEQwmrEIzXUyD9eSivqkejOBx03AHPkxP3AETyZxfJStuGTvBTM4KwsGPl eddg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785082518; x=1785687318; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bagmeEHehug/GOrhos1Z3fTBlBFSZT78kPrPQp6rhbY=; b=IC+wMg+PEOZmGkUOvwaHnDkDol6MMlsGQVkbS9PggpWI1aOatSssmMQyyIv8jBCorg 4TY2fQ72Mj6LJPQv2rV5AVeSD6Xe6sxhcdAMq6hDwDV5cDfOiV2YHfl5ub/v+FBlT61E 28fG6XgQLYsE2ka3sl41OuOMWHXUbKRpz/C1si7bbE6eBrcBghjZ0xC/pbudqw64paIY AYZF9hJa48rRBeyXUAuf9ld+oQruILXY7LVvusfDbhuBSRVq1p6I2Bn85Tb6pRlTlUp1 +nmG0vBvqiuBOGgxOq8z+mi36xANiL4ve8FoCYfZNCu+m5rNG9134aVcJlShZ2PUhnsB /sEw== X-Forwarded-Encrypted: i=1; AHgh+Rr6uijTS25H2Zi4NSzZOeozvEFxQJR0DmTiEPNdXe0KY8wMSosiUKdmuv59wlUFjxYRyPJuUhUIuIF4aqU=@vger.kernel.org X-Gm-Message-State: AOJu0YxEgN+U+Nf3yPMDjzci5pI3bVDGj3zcJXAENYBS/yvH4uZPZd0n NErIcJ83ukl0m4nTO488Q/zsMeeDby1NXlDnHkSMhr6Kulq4flg5Ekhnw3h/uhbt0k8= X-Gm-Gg: AR+sD11tA59jVyWIJ7v2P1S0QhhLvhFFH6Ttrxow1LFnBF7BKl19HVgHFW5kRQjHPrM 9MrcaHasOBB2j8fSnZ+h3kEfopfet8LuH9hY5N0nrKQjnpwwN46h6UtdGMg7v0uOkKjHxhGWb+A U/NFSopaX69B1IwvHrT7Ipd8paamQqLxMyEfotx5ZCXjzzM1Vur/8DWh3cIurwFGnmiYpF/3PfO SMh5Lt+U5yaZVzaGKJUhjx+EKBtDRFKf/+TozGCmdGG3VAMUZmG3AWvO1uPn6v/p5tsiEiOXUh+ jsJK9VBelbBuo+tClABCyKfg9FeGeSgrDNBklBfZcWI3POsmnaVUzzh/O/iwly1jWQsg9hcZVsg XKapYdtMkA2Kg34K6d6Opne1B2nWsMdi5EHuv5rTdzvZhBqggPgI= X-Received: by 2002:a17:903:1110:b0:2cf:ba0c:aa5a with SMTP id d9443c01a7336-2cfde8af449mr45818245ad.47.1785082517786; Sun, 26 Jul 2026 09:15:17 -0700 (PDT) Received: from ziepe.ca ([64.114.68.211]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cfde59bc68sm21236295ad.2.2026.07.26.09.15.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Jul 2026 09:15:17 -0700 (PDT) Received: from jgg by jggl with local (Exim 4.95) (envelope-from ) id 1wo1VU-0001KZ-M1; Sun, 26 Jul 2026 13:15:16 -0300 Date: Sun, 26 Jul 2026 13:15:16 -0300 From: Jason Gunthorpe To: Will Deacon Cc: Peiyang He , joro@8bytes.org, kevin.tian@intel.com, robin.murphy@arm.com, iommu@lists.linux.dev, linux-kernel@vger.kernel.org, baolu.lu@linux.intel.com Subject: Re: [PATCH v3 0/2] iommu/iommufd: Fix IOPF group ownership UAF Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Sun, Jul 26, 2026 at 01:43:55PM +0100, Will Deacon wrote: > On Mon, Jul 20, 2026 at 04:50:15PM +0800, Peiyang He wrote: > > This series fixes a UAF caused by an IOPF group being owned both by the > > generic pending list and IOMMUFD's userspace fault queues: > > > > 1/2 Minimum fix: dequeue accepted groups before IOMMUFD queues them > > for userspace response, then remove the check on list_empty() > > in iopf_group_response(). > > > > 2/2 Refactor: make iopf_group_response() free the group as well > > after responding. > > > > Changes in v3: > > - split the v2 patch into a minimum UAF fix and a follow-up cleanup > > (suggested by Kevin) > > Oops, I lost track of this as all the versions of the patches are in the > same thread. Please try to avoid that, as it makes it hard to track in > an email client and can also confuse tools such as b4. > > Anyway, it looks like v3 is ready to go. Jason, is this something you > are planning to pick up or shall we take it via the IOMMU tree? It looks > like patch 1 should go in for -rc. Yeah I have a bunch of iommufd thing for rc I'l pick it Thanks, Jason