Claude review: accel/amdxdna: Fix user buffer VMA checking and page pinning locking

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: accel/amdxdna: Fix user buffer VMA checking and page pinning locking
Author: Lizhi Hou <lizhi.hou@amd.com>
Patches: 1
Reviewed: 2026-05-16T08:54:21.992526

---

This is a single-patch fix addressing a real **TOCTOU (time-of-check-time-of-use) vulnerability** in the amdxdna accelerator driver's user buffer handling. The core problem was that VMA permission checking (`readonly_va_entry`) and page pinning (`pin_user_pages_fast`) were done without a common lock, allowing an attacker to modify the VMA (via `mprotect`, `munmap`/`mmap`, etc.) between the check and the pin.

The fix is well-targeted and correct in its approach:
1. Holds `mmap_read_lock` across **both** the VMA permission check and the page pinning.
2. Switches from `pin_user_pages_fast` to `pin_user_pages`, which expects the caller to already hold `mmap_read_lock`.
3. Adds `VM_MAYWRITE` to the writability check to close a `mprotect`-based bypass.

The error paths are correctly restructured (goto → break, with unlock before cleanup jump). The locking semantics are consistent with the GUP API contract.

**One minor concern** exists (detailed below) but overall this is a sound security fix that should be accepted.

---

---
Generated by Claude Code Patch Reviewer