[RFC 3/6] dax: refuse dmabuf iterators in dax_iomap_rw()

From: Mengmeng Zhao

Date: Thu Nov 05 2026 - 02:03:33 EST


From: Mengmeng Zhao <zhaomengmeng@xxxxxxxxxx>

A dax access copies through the CPU linear address, which a device
mapping cannot provide. A dmabuf iterator reaching dax_iomap_rw()
splats a WARN_ON_ONCE from iterate_and_advance2() and fails the I/O
with EFAULT. Refuse it up front with -EOPNOTSUPP, as the generic
buffered copy paths already do.

Signed-off-by: Mengmeng Zhao <zhaomengmeng@xxxxxxxxxx>
Signed-off-by: Li Wang <liwang@xxxxxxxxxx>
---
fs/dax.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/fs/dax.c b/fs/dax.c
index 6ba50142eeb2..6ec08316aa6c 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -1759,6 +1759,10 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
if (!iomi.len)
return 0;

+ /* dax copies through the CPU, which a device mapping bypasses */
+ if (iov_iter_is_dmabuf_map(iter))
+ return -EOPNOTSUPP;
+
if (iov_iter_rw(iter) == WRITE) {
lockdep_assert_held_write(&iomi.inode->i_rwsem);
iomi.flags |= IOMAP_WRITE;
--
2.43.0