mirror of https://github.com/torvalds/linux.git
d4c7fccfa7
Two user triggerable UAFs:
- Possible race UAF setting up mmaps
- Syzkaller found UAF when erroring an file descriptor creation ioctl due
to the fput() work queue.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaNFXCgAKCRCFwuHvBreF
YXoFAP9xzBDOVp64CJBY8cD/URaQc8t55b8uJCYgxbDesQa4iAEAxTX9gdZ7Lr6Z
THwdY00LI040gBHUxIZOaXNeOhuPIg8=
=DQIy
-----END PGP SIGNATURE-----
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
Pull iommufd fixes from Jason Gunthorpe:
"Fix two user triggerable use-after-free issues:
- Possible race UAF setting up mmaps
- Syzkaller found UAF when erroring an file descriptor creation ioctl
due to the fput() work queue"
* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
iommufd/selftest: Update the fail_nth limit
iommufd: WARN if an object is aborted with an elevated refcount
iommufd: Fix race during abort for file descriptors
iommufd: Fix refcounting race during mmap
|
||
|---|---|---|
| .. | ||
| amd | ||
| arm | ||
| intel | ||
| iommufd | ||
| riscv | ||
| Kconfig | ||
| Makefile | ||
| apple-dart.c | ||
| dma-iommu.c | ||
| dma-iommu.h | ||
| exynos-iommu.c | ||
| fsl_pamu.c | ||
| fsl_pamu.h | ||
| fsl_pamu_domain.c | ||
| fsl_pamu_domain.h | ||
| hyperv-iommu.c | ||
| io-pgfault.c | ||
| io-pgtable-arm-v7s.c | ||
| io-pgtable-arm.c | ||
| io-pgtable-arm.h | ||
| io-pgtable-dart.c | ||
| io-pgtable.c | ||
| iommu-debugfs.c | ||
| iommu-pages.c | ||
| iommu-pages.h | ||
| iommu-priv.h | ||
| iommu-sva.c | ||
| iommu-sysfs.c | ||
| iommu-traces.c | ||
| iommu.c | ||
| iova.c | ||
| ipmmu-vmsa.c | ||
| irq_remapping.c | ||
| irq_remapping.h | ||
| msm_iommu.c | ||
| msm_iommu.h | ||
| msm_iommu_hw-8xxx.h | ||
| mtk_iommu.c | ||
| mtk_iommu_v1.c | ||
| of_iommu.c | ||
| omap-iommu-debug.c | ||
| omap-iommu.c | ||
| omap-iommu.h | ||
| omap-iopgtable.h | ||
| rockchip-iommu.c | ||
| s390-iommu.c | ||
| sprd-iommu.c | ||
| sun50i-iommu.c | ||
| tegra-smmu.c | ||
| virtio-iommu.c | ||