Commit e771677c937d for kernel

commit e771677c937da5808f7b6c1f0e4a97ec1a84f8a8
Merge: d076a8d3b9b3 e28bee5b4451
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Jun 17 12:33:23 2026 -0700

    Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

    Pull iommufd updates from Jason Gunthorpe:
     "All various fixes:

       - Typo breaking the veventq uAPI for 32 bit userspace

       - Several Sashiko found errors in the veventq and fault fd paths

       - Fix incorrect use of dmabuf locks, and possible races with iommufd
         destroy and dmabuf revoke

       - Sashiko errors found in the uAPI validation for IOMMU_HWPT_INVALIDATE"

    * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
      iommu: Avoid copying the user array twice in the full-array copy helper
      iommufd/selftest: Add invalidation entry_num and entry_len boundary tests
      iommufd: Set upper bounds on cache invalidation entry_num and entry_len
      iommufd: Clarify IOAS_MAP_FILE dma-buf support
      iommufd: Destroy the pages content after detaching from dmabuf
      iommufd: Take dma_resv lock before dma_buf_unpin() in release path
      iommufd/selftest: Cover invalid read counts on vEVENTQ FD
      iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
      iommufd: Break the loop on failure in iommufd_fault_fops_read()
      iommufd: Reject invalid read count in iommufd_fault_fops_read()
      iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
      iommufd: Reject invalid read count in iommufd_veventq_fops_read()
      iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
      iommufd/selftest: Add boundary tests for veventq_depth
      iommufd: Set veventq_depth upper bound
      iommufd: Move vevent memory allocation outside spinlock
      iommufd: Fix data_len byte-count vs element-count mismatch
      iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read