Re: [PATCH v6 14/20] dma-direct: return struct page from dma_direct_alloc_from_pool()
From: Petr Tesarik <hidden>
Date: 2026-06-09 13:12:35
Also in:
linux-arm-kernel, linux-coco, linux-iommu, linux-s390, lkml, stable
On Thu, 4 Jun 2026 14:09:53 +0530 "Aneesh Kumar K.V (Arm)" [off-list ref] wrote:
Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool
helper") changed dma_direct_alloc_from_pool() to return the CPU address
from dma_alloc_from_pool(). That fits dma_direct_alloc(), but
dma_direct_alloc_pages() also uses the helper and expects a struct page *.
Fix this by making dma_direct_alloc_from_pool() return the struct page *
again, and pass the CPU address back through an out-parameter for the
dma_direct_alloc() caller.
Fixes: 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper")
Cc: stable@vger.kernel.orgWhile I totally agree with the reasoning and the fix, it's interesting that this bug has been apparently present in the kernel for 5+ years without anybody hitting nasty memory corruption bugs. How can it be? Is the buggy code path never actually used in practice? Does it hint at a missed opportunity to simplify the code? Anyway, these these thoughts are intended for a possible future cleanup. For now, let's apply the fix as is, of course. Petr T
quoted hunk ↗ jump to hunk
Tested-by: Michael Kelley <redacted> Tested-by: Mostafa Saleh <smostafa@google.com> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org> --- kernel/dma/direct.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c index 4e446aa4130e..e0ab9ff3f1d6 100644 --- a/kernel/dma/direct.c +++ b/kernel/dma/direct.c@@ -157,24 +157,24 @@ static bool dma_direct_use_pool(struct device *dev, gfp_t gfp) return !gfpflags_allow_blocking(gfp) && !is_swiotlb_for_alloc(dev); } -static void *dma_direct_alloc_from_pool(struct device *dev, size_t size, - dma_addr_t *dma_handle, gfp_t gfp, unsigned long attrs) +static struct page *dma_direct_alloc_from_pool(struct device *dev, size_t size, + dma_addr_t *dma_handle, void **cpu_addr, gfp_t gfp, + unsigned long attrs) { struct page *page; u64 phys_limit; - void *ret; if (WARN_ON_ONCE(!IS_ENABLED(CONFIG_DMA_COHERENT_POOL))) return NULL; gfp |= dma_direct_optimal_gfp_mask(dev, &phys_limit); - page = dma_alloc_from_pool(dev, size, &ret, gfp, attrs, + page = dma_alloc_from_pool(dev, size, cpu_addr, gfp, attrs, dma_coherent_ok); if (!page) return NULL; *dma_handle = phys_to_dma_direct(dev, page_to_phys(page), !!(attrs & DMA_ATTR_CC_SHARED)); - return ret; + return page; } static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size,@@ -270,9 +270,12 @@ void *dma_direct_alloc(struct device *dev, size_t size, * the atomic pools instead if we aren't allowed block. */ if ((remap || (attrs & DMA_ATTR_CC_SHARED)) && - dma_direct_use_pool(dev, gfp)) - return dma_direct_alloc_from_pool(dev, size, dma_handle, - gfp, attrs); + dma_direct_use_pool(dev, gfp)) { + page = dma_direct_alloc_from_pool(dev, size, + dma_handle, &cpu_addr, + gfp, attrs); + return page ? cpu_addr : NULL; + } if (is_swiotlb_for_alloc(dev)) { page = dma_direct_alloc_swiotlb(dev, size, attrs);@@ -445,7 +448,7 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, if ((attrs & DMA_ATTR_CC_SHARED) && dma_direct_use_pool(dev, gfp)) return dma_direct_alloc_from_pool(dev, size, dma_handle, - gfp, attrs); + &cpu_addr, gfp, attrs); if (is_swiotlb_for_alloc(dev)) { page = dma_direct_alloc_swiotlb(dev, size, attrs);