archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 01:24:47 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova

Browse source 
When dma_iova_link() fails partway through mapping a request's bvec
list, the function breaks out of the loop without cleaning up
already mapped segments. Similarly, if dma_iova_sync() fails after
linking all segments, no cleanup is performed.

This leaves partial IOVA mappings in place. The completion path
attempts to unmap the full expected size via dma_iova_destroy() or
nvme_unmap_data(), but only a partial size was actually mapped,
leading to incorrect unmap operations.

Add an out_unlink error path that calls dma_iova_destroy() to clean
up partial mappings before returning failure. The dma_iova_destroy()
function handles both partial unlink and IOVA space freeing. It
correctly handles the mapped_len == 0 case (first dma_iova_link()
failure) by only freeing the IOVA allocation without attempting to
unmap.

Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Chaitanya Kulkarni 2026-02-11 12:49:44 -08:00 • committed by Jens Axboe
parent 5991bfa3f8
commit 81e7223b1a
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
block/blk-mq-dma.c
View file

@ -121,17 +121,20 @@ static bool blk_rq_dma_map_iova(struct request *req, struct device *dma_dev,
error = dma_iova_link(dma_dev, state, vec->paddr, mapped,
vec->len, dir, attrs);
if (error)
break;
goto out_unlink;
mapped += vec->len;
} while (blk_map_iter_next(req, &iter->iter, vec));
error = dma_iova_sync(dma_dev, state, 0, mapped);
if (error) {
iter->status = errno_to_blk_status(error);
return false;
}
if (error)
goto out_unlink;
return true;
out_unlink:
dma_iova_destroy(dma_dev, state, mapped, dir, attrs);
iter->status = errno_to_blk_status(error);
return false;
}
static inline void blk_rq_map_iter_init(struct request *rq,