diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2025-09-22 11:16:14 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2025-09-22 11:16:14 -0700 |
| commit | d4c7fccfa784da0583fed9c8f98ed78236c030fb (patch) | |
| tree | a820da3a60d3c25c942921fba1922f36a775648b /tools | |
| parent | b183f251e2024531c2262829e97907b0e623cc41 (diff) | |
| parent | 43f6bee02196e56720dd68eea847d213c6e69328 (diff) | |
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
Pull iommufd fixes from Jason Gunthorpe:
"Fix two user triggerable use-after-free issues:
- Possible race UAF setting up mmaps
- Syzkaller found UAF when erroring an file descriptor creation ioctl
due to the fput() work queue"
* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
iommufd/selftest: Update the fail_nth limit
iommufd: WARN if an object is aborted with an elevated refcount
iommufd: Fix race during abort for file descriptors
iommufd: Fix refcounting race during mmap
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/testing/selftests/iommu/iommufd_fail_nth.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/testing/selftests/iommu/iommufd_fail_nth.c b/tools/testing/selftests/iommu/iommufd_fail_nth.c index 651fc9f13c08..45c14323a618 100644 --- a/tools/testing/selftests/iommu/iommufd_fail_nth.c +++ b/tools/testing/selftests/iommu/iommufd_fail_nth.c @@ -113,7 +113,7 @@ static bool fail_nth_next(struct __test_metadata *_metadata, * necessarily mean a test failure, just that the limit has to be made * bigger. */ - ASSERT_GT(400, nth_state->iteration); + ASSERT_GT(1000, nth_state->iteration); if (nth_state->iteration != 0) { ssize_t res; ssize_t res2; |