linux-kernel - Re: next-20250627: IOMMU DMA warning during NVMe I/O completion after 06cae0e3f61c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <07c07d1f-2eb6-437f-931c-0f04b129eb08@samsung.com>
Date: Thu, 3 Jul 2025 11:24:20 +0530
From: Kanchan Joshi <joshi.k@...sung.com>
To: Ben Copeland <ben.copeland@...aro.org>, linux-kernel@...r.kernel.org,
	lkft-triage@...ts.linaro.org, regressions@...ts.linux.dev,
	linux-nvme@...ts.infradead.org
Cc: Dan Carpenter <dan.carpenter@...aro.org>, kbusch@...nel.org,
	axboe@...nel.dk, hch@....de, sagi@...mberg.me
Subject: Re: next-20250627: IOMMU DMA warning during NVMe I/O completion
 after 06cae0e3f61c

On 6/30/2025 1:20 PM, Ben Copeland wrote:
> # first bad commit: [06cae0e3f61c4c1ef18726b817bbb88c29f81e57]
> nvme-pci: merge the simple PRP and SGL setup into a common helper

this patch had the problem [0] of not setting 'iod->first_dma' which can 
trigger that IOMMU warning on unmap.
But problem was transient as a subsequent patch removed the 
iod->first_dma and made unmapping work without that.

[0]
-static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev,
-               struct request *req, struct nvme_rw_command *cmnd,
-               struct bio_vec *bv)
+static blk_status_t nvme_pci_setup_data_simple(struct request *req,
+               enum nvme_use_sgl use_sgl)
  {
         struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
-       unsigned int offset = bv->bv_offset & (NVME_CTRL_PAGE_SIZE - 1);
-       unsigned int first_prp_len = NVME_CTRL_PAGE_SIZE - offset;
-
-       iod->first_dma = dma_map_bvec(dev->dev, bv, rq_dma_dir(req), 0);
-       if (dma_mapping_error(dev->dev, iod->first_dma))

iod->first_dma does not get set, and that can cause unmap on invalid 
address during teardown.