linux-kernel - [report] DMA-API: platform vgem: mapping sg segment longer than device claims to support [len=1048576] [max=65536]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6d22bce3-4533-4cfa-96ba-64352b715741@linux.dev>
Date: Thu, 19 Jun 2025 00:03:11 +0800
From: Zenghui Yu <zenghui.yu@...ux.dev>
To: dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Cc: airlied@...il.com, simona@...ll.ch, maarten.lankhorst@...ux.intel.com,
 mripard@...nel.org, tzimmermann@...e.de
Subject: [report] DMA-API: platform vgem: mapping sg segment longer than
 device claims to support [len=1048576] [max=65536]

Hi all,

Running the dmabuf-heap test [*] on mainline kernel triggers the
following splat:

 ------------[ cut here ]------------
 DMA-API: platform vgem: mapping sg segment longer than device claims to
support [len=1048576] [max=65536]
 WARNING: CPU: 7 PID: 1126 at kernel/dma/debug.c:1174
debug_dma_map_sg+0x348/0x3e4
 Modules linked in: vgem drm_shmem_helper drm_kms_helper rfkill drm fuse
backlight sha3_ce sha512_ce ipv6
 CPU: 7 UID: 0 PID: 1126 Comm: dmabuf-heap Kdump: loaded Not tainted
6.16.0-rc2-00024-g9afe652958c3-dirty PREEMPT
 Hardware name: QEMU QEMU Virtual Machine, BIOS
edk2-stable202408-prebuilt.qemu.org 08/13/2024
 pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
 pc : debug_dma_map_sg+0x348/0x3e4
 lr : debug_dma_map_sg+0x348/0x3e4
 sp : ffff800084313a50
 x29: ffff800084313a50 x28: ffff0000c0a62480 x27: 0000000000000001
 x26: ffffffffffffffff x25: 0000000000000000 x24: ffff0000c0985f20
 x23: ffff8000815ab058 x22: 0000000000000001 x21: 0000000000000001
 x20: 0000000000000000 x19: ffff0000c2797010 x18: 0000000000000020
 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000ffffffff
 x14: ffff8000815c6390 x13: 00000000000005bb x12: 00000000000001e9
 x11: fffffffffffe8360 x10: ffff80008161e390 x9 : 00000000fffff000
 x8 : ffff8000815c6390 x7 : ffff80008161e390 x6 : 0000000000000000
 x5 : ffff0001fee21308 x4 : 0000000000000001 x3 : 0000000000000000
 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c5ea4600
 Call trace:
  debug_dma_map_sg+0x348/0x3e4 (P)
  __dma_map_sg_attrs+0xbc/0x118
  dma_map_sgtable+0x28/0x44
  system_heap_map_dma_buf+0x2c/0x64
  dma_buf_map_attachment+0x60/0x184
  dma_buf_map_attachment_unlocked+0x3c/0x7c
  drm_gem_prime_import_dev.part.0+0x58/0x130 [drm]
  drm_gem_prime_import+0x48/0xc4 [drm]
  drm_gem_prime_fd_to_handle+0x180/0x220 [drm]
  drm_prime_fd_to_handle_ioctl+0x38/0x44 [drm]
  drm_ioctl_kernel+0xb8/0x12c [drm]
  drm_ioctl+0x204/0x4ec [drm]
  __arm64_sys_ioctl+0xac/0x104
  invoke_syscall+0x48/0x110
  el0_svc_common.constprop.0+0x40/0xe0
  do_el0_svc+0x1c/0x28
  el0_svc+0x34/0x108
  el0t_64_sync_handler+0xc8/0xcc
  el0t_64_sync+0x198/0x19c
 ---[ end trace 0000000000000000 ]---

The kernel is built with arm64's virtconfig and

+CONFIG_DMABUF_HEAPS=y
+CONFIG_DMABUF_HEAPS_SYSTEM=y
+CONFIG_DRM_VGEM=m
+CONFIG_DMA_API_DEBUG=y

[*] linux/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c

Thanks,
Zenghui