linux-kernel - Re: [PATCH rdma-next 1/2] RDMA/uverbs: Add DMABUF object type and operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260125143143.GF13967@unreal>
Date: Sun, 25 Jan 2026 16:31:43 +0200
From: Leon Romanovsky <leon@...nel.org>
To: Edward Srouji <edwards@...dia.com>
Cc: Jason Gunthorpe <jgg@...pe.ca>, Sumit Semwal <sumit.semwal@...aro.org>,
	Christian König <christian.koenig@....com>,
	linux-kernel@...r.kernel.org, linux-rdma@...r.kernel.org,
	linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org,
	linaro-mm-sig@...ts.linaro.org, Yishai Hadas <yishaih@...dia.com>
Subject: Re: [PATCH rdma-next 1/2] RDMA/uverbs: Add DMABUF object type and
 operations

On Thu, Jan 08, 2026 at 01:11:14PM +0200, Edward Srouji wrote:
> From: Yishai Hadas <yishaih@...dia.com>
> 
> Expose DMABUF functionality to userspace through the uverbs interface,
> enabling InfiniBand/RDMA devices to export PCI based memory regions
> (e.g. device memory) as DMABUF file descriptors. This allows
> zero-copy sharing of RDMA memory with other subsystems that support the
> dma-buf framework.
> 
> A new UVERBS_OBJECT_DMABUF object type and allocation method were
> introduced.
> 
> During allocation, uverbs invokes the driver to supply the
> rdma_user_mmap_entry associated with the given page offset (pgoff).
> 
> Based on the returned rdma_user_mmap_entry, uverbs requests the driver
> to provide the corresponding physical-memory details as well as the
> driver’s PCI provider information.
> 
> Using this information, dma_buf_export() is called; if it succeeds,
> uobj->object is set to the underlying file pointer returned by the
> dma-buf framework.
> 
> The file descriptor number follows the standard uverbs allocation flow,
> but the file pointer comes from the dma-buf subsystem, including its own
> fops and private data.
> 
> Because of this, alloc_begin_fd_uobject() must handle cases where
> fd_type->fops is NULL, and both alloc_commit_fd_uobject() and
> alloc_abort_fd_uobject() must account for whether filp->private_data
> exists, since it is only populated after a successful dma_buf_export().
> 
> When an mmap entry is removed, uverbs iterates over its associated
> DMABUFs, marks them as revoked, and calls dma_buf_move_notify() so that
> their importers are notified.
> 
> The same procedure applies during the disassociate flow; final cleanup
> occurs when the application closes the file.
> 
> Signed-off-by: Yishai Hadas <yishaih@...dia.com>
> Signed-off-by: Edward Srouji <edwards@...dia.com>
> ---
>  drivers/infiniband/core/Makefile                  |   1 +
>  drivers/infiniband/core/device.c                  |   2 +
>  drivers/infiniband/core/ib_core_uverbs.c          |  19 +++
>  drivers/infiniband/core/rdma_core.c               |  63 ++++----
>  drivers/infiniband/core/rdma_core.h               |   1 +
>  drivers/infiniband/core/uverbs.h                  |  10 ++
>  drivers/infiniband/core/uverbs_std_types_dmabuf.c | 172 ++++++++++++++++++++++
>  drivers/infiniband/core/uverbs_uapi.c             |   1 +
>  include/rdma/ib_verbs.h                           |   9 ++
>  include/rdma/uverbs_types.h                       |   1 +
>  include/uapi/rdma/ib_user_ioctl_cmds.h            |  10 ++
>  11 files changed, 263 insertions(+), 26 deletions(-)

<...>

> +static struct sg_table *
> +uverbs_dmabuf_map(struct dma_buf_attachment *attachment,
> +		  enum dma_data_direction dir)
> +{
> +	struct ib_uverbs_dmabuf_file *priv = attachment->dmabuf->priv;
> +
> +	dma_resv_assert_held(priv->dmabuf->resv);
> +
> +	if (priv->revoked)
> +		return ERR_PTR(-ENODEV);
> +
> +	return dma_buf_phys_vec_to_sgt(attachment, priv->provider,
> +				       &priv->phys_vec, 1, priv->phys_vec.len,
> +				       dir);
> +}
> +
> +static void uverbs_dmabuf_unmap(struct dma_buf_attachment *attachment,
> +				struct sg_table *sgt,
> +				enum dma_data_direction dir)
> +{
> +	dma_buf_free_sgt(attachment, sgt, dir);
> +}

Unfortunately, it is not enough. Exporters should count their
map<->unmap calls and make sure that they are equal.

See this VFIO change https://lore.kernel.org/kvm/20260124-dmabuf-revoke-v5-4-f98fca917e96@nvidia.com/

Thanks