Re: [PATCH] iommufd: Reject DMABUF pages from the access pin path

[Jason Gunthorpe <jgg@ziepe.ca>]

On Thu, Jul 09, 2026 at 01:08:00PM +0800, Peiyang He wrote:
> DMABUF pages are not supported for iommufd access pinning.
> iommufd_access_pin_pages() returns struct page pointers for
> in-kernel CPU access, but DMABUF-backed iopt_pages do not carry
> a userspace address that can be passed to the GUP path.
> 
> iopt_pages_rw_access() already rejects IOPT_ADDRESS_DMABUF before doing
> CPU access. Apply the same rejection to iopt_area_add_access() before it
> takes pages->mutex and calls iopt_pages_fill_xarray().
> Otherwise a DMABUF-backed iopt_pages can reach the hole-fill path, where
> pfn_reader_user_pin() interprets the union as uptr and
> calls pin_user_pages_fast()/pin_user_pages_remote().
> 
> This fix also avoids the lockdep warning reported from that path, where
> pages_dmabuf_mutex_key is held while gup_fast_fallback() may acquire
> mmap_lock.
> 
> Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Closes: https://lore.kernel.org/all/E8540D7D05768C91+8b2ef227-3368-494e-909d-7b28e1489dfb@smail.nju.edu.cn/
> Fixes: 71db84a092c3 ("iommufd: Add DMABUF to iopt_pages")
> Cc: stable@vger.kernel.org
> Tested-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> ---
>  drivers/iommu/iommufd/pages.c | 3 +++
>  1 file changed, 3 insertions(+)

Applied thanks

Jason