* Re: [PATCH] iommu/iommufd: Require write access for writable MAP_FILE mappings
[not found] <20260607085320.73274-1-yimingqian591@gmail.com>
@ 2026-06-07 12:09 ` Jason Gunthorpe
0 siblings, 0 replies; only message in thread
From: Jason Gunthorpe @ 2026-06-07 12:09 UTC (permalink / raw)
To: Yiming Qian, David Hildenbrand, Vivek Kasireddy
Cc: Kevin Tian, Joerg Roedel, Will Deacon, Robin Murphy, iommu,
linux-kernel, keenanat2000, linux-mm, Christoph Hellwig,
John Hubbard, Peter Xu
On Sun, Jun 07, 2026 at 08:53:18AM +0000, Yiming Qian wrote:
> IOMMU_IOAS_MAP_FILE pins folios from a shmem/tmpfs or hugetlb file and
> uses them as the backing storage for an IOAS mapping. When userspace sets
> IOMMU_IOAS_MAP_WRITEABLE, the resulting IOMMU PTEs allow DMA writes to the
> file-backed folios.
This looks like an issue with the API design in memfd_pin_folios(),
all users would have a similar bug I think.
I don't know much about memfd but this seems like a legitimate issue.
Add those involved with gup.c and the patch adding memfd_pin_folios()
> {
> struct iopt_pages *pages;
> + int rc;
> +
> + if (writable) {
> + if (!(file->f_mode & FMODE_WRITE))
> + return ERR_PTR(-EPERM);
> +
> + rc = mapping_map_writable(file->f_mapping);
> + if (rc)
> + return ERR_PTR(rc);
> + }
We probably need some kind of companion API for memfd_pin_folios(), a
start/pin/destroy kind of thing to manage this?
It should not be open coded like this.
Jason
^ permalink raw reply [flat|nested] only message in thread