Commit e05b559f9cda for kernel

commit e05b559f9cda350d0ab33c44a8c1151ca62d2875
Merge: 9e2e9da4de75 738e6f32e61d
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 30 15:12:31 2026 -0700

    Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

    Pull iommufd fixes from Jason Gunthorpe:
     "Several bug fixes found by tools and fuzzing:

       - Incorrect domain passed during replace to ack faults

       - Block the access API from using dmabuf

       - Missing unlock on error unwind

       - Race seeing a partially setup vdevice in the xarray

       - Do not allow vdevices to have multiple stream ids in SMMUv3

       - Possible UAF if racing faults with domain changes"

    * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
      iommu/iommufd: Fix IOPF group ownership UAF
      iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
      iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
      iommufd/viommu: Release the igroup lock on the vdevice_size error path
      iommufd: Reject DMABUF pages from the access pin path
      iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace