Re: [PATCH v3 1/5] kernel/user: Allow user _struct::locked_vm to be usable for iommufd

On 17 August 2026 21:16:02 BST, Farhan Ali <[email protected]> wrote:
>From: Jason Gunthorpe <[email protected]>
>
>Following the pattern of io_uring, perf, skb, and bpf, iommfd will use
>user->locked_vm for accounting pinned pages. Ensure the value is included
>in the struct and export free_uid() as iommufd is modular.
>
>user->locked_vm is the good accounting to use for ulimit because it is
>per-user, and the security sandboxing of locked pages is not supposed to
>be per-process. Other places (vfio, vdpa and infiniband) have used
>mm->pinned_vm and/or mm->locked_vm for accounting pinned pages, but this
>is only per-process and inconsistent with the new FOLL_LONGTERM users in
>the kernel.
>
>Concurrent work is underway to try to put this in a cgroup, so everything
>can be consistent and the kernel can provide a FOLL_LONGTERM limit that
>actually provides security.
>
>Link: https://lore.kernel.org/r/[email protected]
>Reviewed-by: Kevin Tian <[email protected]>
>Reviewed-by: Eric Auger <[email protected]>

Reviewed-by: Bradley Morgan <[email protected]> # kernel/

>Tested-by: Nicolin Chen <[email protected]>
>Tested-by: Yi Liu <[email protected]>
>Tested-by: Lixiao Yang <[email protected]>
>Tested-by: Matthew Rosato <[email protected]>
>Signed-off-by: Jason Gunthorpe <[email protected]>
>(cherry picked from commit ce5a23c835aa0f0a931b5bcde1e7811f951b0146)
>Signed-off-by: Farhan Ali <[email protected]>
>---
> include/linux/sched/user.h | 2 +-
> kernel/user.c              | 1 +
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
>index f054d0360a75..4cc52698e214 100644
>--- a/include/linux/sched/user.h
>+++ b/include/linux/sched/user.h
>@@ -25,7 +25,7 @@ struct user_struct {
> 
> #if defined(CONFIG_PERF_EVENTS) || defined(CONFIG_BPF_SYSCALL) || \
> 	defined(CONFIG_NET) || defined(CONFIG_IO_URING) || \
>-	defined(CONFIG_VFIO_PCI_ZDEV_KVM)
>+	defined(CONFIG_VFIO_PCI_ZDEV_KVM) || IS_ENABLED(CONFIG_IOMMUFD)
> 	atomic_long_t locked_vm;
> #endif
> #ifdef CONFIG_WATCH_QUEUE
>diff --git a/kernel/user.c b/kernel/user.c
>index e2cf8c22b539..d667debeafd6 100644
>--- a/kernel/user.c
>+++ b/kernel/user.c
>@@ -185,6 +185,7 @@ void free_uid(struct user_struct *up)
> 	if (refcount_dec_and_lock_irqsave(&up->__count, &uidhash_lock, &flags))
> 		free_user(up, flags);
> }
>+EXPORT_SYMBOL_GPL(free_uid);
> 
> struct user_struct *alloc_uid(kuid_t uid)
> {
>


Thanks!