From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f175.google.com (mail-qt1-f175.google.com [209.85.160.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F34D346FDA for ; Mon, 13 Jul 2026 17:28:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963721; cv=none; b=lJsW44FwACWxlSc17D2iS1f6dUUxcqcYMpA8UMUdpIx6S05h9Y+8Xx0PK11z2+Eu0kxq7F4PwzAuqtDcKypFBg0BM9wdA8LQ4R331tQOSY6p7Ixvn/ChCYpixIifb7VolaWNYSBNvLXdXEHtiS07mBIDg6PV9ssCObS3Ap6n0D0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963721; c=relaxed/simple; bh=gT9s9oRpIiwyq5GIG9RUX0KOjdNXvmY7rnr7/TrhcE0=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=oEP+f8wctsIOcVKzw/U/wsmJgPdkblkRncv9r/afmfD9V0MIxHKUGq0Am0zridiHtETVxNEEMScvHKl0rFKifM/pCdYnXkxb9MoECI/XZjQn6ZsP5Ur8vOTsxfZUdayftkqzh8sJEprGyNNyBMNhhKznNCVqj6Wdfmlc+THBHKE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=gwIhX+za; arc=none smtp.client-ip=209.85.160.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="gwIhX+za" Received: by mail-qt1-f175.google.com with SMTP id d75a77b69052e-51c2c8f43aaso29798891cf.1 for ; Mon, 13 Jul 2026 10:28:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1783963718; x=1784568518; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=JDQW3Iu7NBoAVzUsdpY0L5+hRHDfdkqTfxv3iduKA6M=; b=gwIhX+za/qpfeQYrKqHRrT/NYBKqy1fcxDs86izaC5tJz8hrqta/fnluLKggVQBGGG U2KTuwo3SiCLMdcAnqO69f24xoLy2SBf/89SZ97ltuOXTbXuPu5xeLSKmEaABLf6aGdy uyDIKEj8dezMmaIR3yPRZbkYP6YPTqbOTIgv0xJhaA/s0+ML6gjpZ1GUBmgqbtN4pLsO 235XCqM5efLvRbg6Q3OFGk045bDFJ45dNzI4CNo4EmxGM1+i5rqyPmEl8Ypl4liZpIFB sNMdL42Iuh3yJGA6PRbzsoCu19OR3I1lkjWMRu+JNQynmOro+/3HUvw3SOh7xIm2ikFu g7JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783963718; x=1784568518; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=JDQW3Iu7NBoAVzUsdpY0L5+hRHDfdkqTfxv3iduKA6M=; b=h+2bxPyraJZ8uhQ0vL1evPFI8qPn8qmoHRWM0250l99xW8F4c33Qzz0Aj7LcP5d2Yd nC9am3Ip0orHHIrx6VdPW5bLpGZJ91bpDJdhbKemAHqGocTASPLM9WkbpVNPKDGHu1f5 w7A2jeS0IYiQyEf+zzhTH2UqlRgfjTaXuNSKChFeyBLOW2vXU846OC2c1zIH2wDubklB xozBlUX8+LvCRJvN28V7VbD0wnJ0Bici/B18UWQZZWG3I2K9YKbac3bitajk2FYaOvP3 msivC8ibQUMx61jFMSR3V61KqePOgKzEUUaeRHThLOc1NVSYEhxNk3g6dJcGhzCM/gWY 7dpA== X-Forwarded-Encrypted: i=1; AHgh+Rrd2msToqt7Oi+1OfVVu1DZ6ctI2lVj7/7cDfdnwZw89ki2V5SGt0jrMl/1E9Hkx543HrSfmo/II2FzqqE=@vger.kernel.org X-Gm-Message-State: AOJu0YyC0pQ2nR71zG31ZY3VgRajGDMMBY1zzxHmu2g+Xmq0GLvTrzRL CnyccRVOZrBr/+smePrHIFPFKBelLN83DZo+OXGsAoWHCzx5suCVpdyvqsSp90xHxSOX4HXN0lb KkueR X-Gm-Gg: AfdE7ck8X5X+XsMufHaUAOZb/Ya+t3nNujcTjhmkVutCMjxFHvtD16kbb5KSd440yRG USRW3vMqc0xfchIQGijfsUyJiYcbmH6jEkD/fMK8CXvrHr1xLJz0GmwKzCkooyFAqwQxUID+3mW z3jYlpfx8l92Om1txVpsupmRscMGfj5zJRyEzxP6ioK10fC8klXllMwzjDT3r6ndOUqNEDSyWKV 3inWcRSRhoaMfZa1NFHcNf+L9v3+QHheMAg2mpF/wl/nbDkCoV/Ux1f5vEwYj34SmthjZblr2H/ rpjg1Hu4AThDCO9GFh4vN4lRf5kWlzXfCZdMV5SFEeQyZ5yiMlfnLWLMb+kDJIycCuDUYVQXgX0 pR2/jrmri4Rtls2wWEyrZ6vfRl/Ccpo1U2w6WAn6BCUxjUgozVNp5bjTndxjN X-Received: by 2002:ac8:5ac1:0:b0:51c:478:32a1 with SMTP id d75a77b69052e-51cbf06d972mr109410031cf.18.1783963717964; Mon, 13 Jul 2026 10:28:37 -0700 (PDT) Received: from ziepe.ca ([159.2.72.92]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51caafd8b4fsm89742801cf.31.2026.07.13.10.28.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 10:28:37 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wjKSK-0000000Dmea-3sFm; Mon, 13 Jul 2026 14:28:36 -0300 Date: Mon, 13 Jul 2026 14:28:36 -0300 From: Jason Gunthorpe To: Peiyang He Cc: kevin.tian@intel.com, joro@8bytes.org, will@kernel.org, iommu@lists.linux.dev, robin.murphy@arm.com, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com, stable@vger.kernel.org Subject: Re: [PATCH] iommufd: Reject DMABUF pages from the access pin path Message-ID: <20260713172836.GG3133966@ziepe.ca> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Thu, Jul 09, 2026 at 01:08:00PM +0800, Peiyang He wrote: > DMABUF pages are not supported for iommufd access pinning. > iommufd_access_pin_pages() returns struct page pointers for > in-kernel CPU access, but DMABUF-backed iopt_pages do not carry > a userspace address that can be passed to the GUP path. > > iopt_pages_rw_access() already rejects IOPT_ADDRESS_DMABUF before doing > CPU access. Apply the same rejection to iopt_area_add_access() before it > takes pages->mutex and calls iopt_pages_fill_xarray(). > Otherwise a DMABUF-backed iopt_pages can reach the hole-fill path, where > pfn_reader_user_pin() interprets the union as uptr and > calls pin_user_pages_fast()/pin_user_pages_remote(). > > This fix also avoids the lockdep warning reported from that path, where > pages_dmabuf_mutex_key is held while gup_fast_fallback() may acquire > mmap_lock. > > Reported-by: Peiyang He > Closes: https://lore.kernel.org/all/E8540D7D05768C91+8b2ef227-3368-494e-909d-7b28e1489dfb@smail.nju.edu.cn/ > Fixes: 71db84a092c3 ("iommufd: Add DMABUF to iopt_pages") > Cc: stable@vger.kernel.org > Tested-by: Peiyang He > Signed-off-by: Peiyang He > --- > drivers/iommu/iommufd/pages.c | 3 +++ > 1 file changed, 3 insertions(+) Applied thanks Jason