CVE-2026-80633: iommufd: Take dma_resv lock before dma_buf_unpin() in release path
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Take dmaresv lock before dmabufunpin() in release path
dmabufunpin() requires the caller to hold the exporter's dmaresv lock:
void dmabufunpin(struct dmabufattachment attach) { ... dmaresvassertheld(dmabuf->resv); ... }
ioptreleasepages() calls dmabufunpin() without taking that lock, so every iommufdioasdestroy()/iommufdioasunmap() that releases the last reference on a DMABUF-backed ioptpages triggers a WARN. This was hit while running tools/testing/selftests/iommu/iommufd:
WARNING: drivers/dma-buf/dma-buf.c:1137 at dmabufunpin+0x62/0x70 RIP: 0010:dmabufunpin+0x62/0x70 Call Trace: <TASK> dmabufunpin+0x62/0x70 ioptreleasepages+0xe4/0x190 ioptunmapiovarange+0x1c7/0x290 ioptunmapall+0x1a/0x30 iommufdioasdestroy+0x1d/0x50 iommufdfopsrelease+0x93/0x150 fput+0xfc/0x2c0 x64sysclose+0x3d/0x80 dosyscall64+0x65/0x180 </TASK>
Take the dmaresv lock around dmabufunpin() in ioptreleasepages(), matching the ioptmapdmabuf() convention. dmabufdetach() acquires the reservation lock internally, so it must remain outside the locked region.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the iopt release path so that iopt_release_pages() takes the exporter dma_resv lock before calling dma_buf_unpin(), following the iopt_map_dmabuf() convention and avoiding moving the internal reservation lock into the locked region; ensure every iommufd_ioas_destroy()/iommufd_ioas_unmap() that releases the last reference on a DMABUF-backed iopt_pages does not trigger the WARN.
Linux kernel (dma-buf / iommufd / iopt release path) dma_resv locking around dma_buf_unpin() in iopt_release_pages() = Take dma_resv lock around dma_buf_unpin() in iopt_release_pages(), matching the iopt_map_dmabuf() convention; keep reservation lock internal and remain outside the locked region
Event History
Frequently Asked Questions
What operation triggers the warning?
The warning occurs when iommufd_ioas_destroy() or iommufd_ioas_unmap() releases the final reference to a DMABUF-backed iopt_pages object. The affected path calls dma_buf_unpin() without holding the exporter’s dma_resv lock.
How can I tell whether a system is affected?
Affected systems can emit a WARN from drivers/dma-buf/dma-buf.c at dma_buf_unpin during IOAS destruction, unmapping, or file release. The reported call trace includes iopt_release_pages, iopt_unmap_iova_range, iommufd_ioas_destroy, and iommufd_fops_release.
What is the required fix?
The release path must take the dma_resv lock around dma_buf_unpin() in iopt_release_pages(), consistent with iopt_map_dmabuf(). dma_buf_detach() must remain outside that locked region because it acquires the reservation lock internally.