[RFC PATCH 1/6] iommufd: Preserve DMA-buf pin errors

From: Karl Mehltretter

Date: Tue Oct 20 2026 - 02:41:27 EST


If dma_buf_pin() fails, iopt_map_dmabuf() replaces its error with
PTR_ERR(pages->dmabuf.exp_phys). The newly allocated pages object still
has a NULL exp_phys, so the function detaches and returns zero. Its
caller then accepts a DMA-buf pages object with no attachment.

Keep the error returned by dma_buf_pin() when unwinding the attachment.

Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
---
drivers/iommu/iommufd/pages.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c
index 98c2a8027..0b32c65af 100644
--- a/drivers/iommu/iommufd/pages.c
+++ b/drivers/iommu/iommufd/pages.c
@@ -1510,10 +1510,8 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages,
}

rc = dma_buf_pin(attach);
- if (rc) {
- rc = PTR_ERR(pages->dmabuf.exp_phys);
+ if (rc)
goto err_detach;
- }

pages->dmabuf.exp_phys = dma_buf_pal_map_phys(attach);
if (IS_ERR(pages->dmabuf.exp_phys)) {
--
2.39.5 (Apple Git-154)