Re: [PATCH] iommufd: Reject DMABUF pages from the access pin path

[Peiyang He]

On 2026/7/13 14:10, Tian, Kevin wrote:
>> From: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
>> Sent: Thursday, July 9, 2026 1:08 PM
>>
>> DMABUF pages are not supported for iommufd access pinning.
>> iommufd_access_pin_pages() returns struct page pointers for
>> in-kernel CPU access, but DMABUF-backed iopt_pages do not carry
>> a userspace address that can be passed to the GUP path.
>>
>> iopt_pages_rw_access() already rejects IOPT_ADDRESS_DMABUF before
>> doing
>> CPU access. Apply the same rejection to iopt_area_add_access() before it
>> takes pages->mutex and calls iopt_pages_fill_xarray().
>> Otherwise a DMABUF-backed iopt_pages can reach the hole-fill path, where
>> pfn_reader_user_pin() interprets the union as uptr and
>> calls pin_user_pages_fast()/pin_user_pages_remote().
>>
>> This fix also avoids the lockdep warning reported from that path, where
>> pages_dmabuf_mutex_key is held while gup_fast_fallback() may acquire
>> mmap_lock.
>>
>> Reported-by: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> 
> this is not required when you are the author

Hi Kevin,
Thanks for your reply! Will send a V2 patch fixing this.

Best,
Peiyang