vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
dma_map_single() and passes its address to the device as the "driver
data" (misc.ddPA/ddLen) in the shared area.
The adapter is the netdev private area, and alloc_netdev_mqs() allocates
it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
and is well above PAGE_SIZE, so when a high-order allocation fails the
adapter ends up in vmalloc memory. dma_map_single() then warns
("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
and probe fails with -EFAULT. syzbot hit this with page allocation
fault injection.
The driver data is only informational. The per-queue descriptors in
this driver already report no driver data with ddPA = ~0ULL and
ddLen = 0, and other vmxnet3 drivers, such as the one in DPDK, never set
misc.ddPA at all.
Drop the mapping and report no driver data in the shared area as well.
This also removes a probe failure path and the adapter_pa field.
Reported-by: <redacted>
Closes: https://syzkaller.appspot.com/bug?extid=8eed6f83440ecdaf4be6
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Arnav Kapoor <redacted>
---
Changes in v2:
- Retarget to net-next and drop the Fixes tag (Jakub)
- Drop the "never synced" part of the commit message (Jakub)
- Add Simon's Reviewed-by
v1: https://lore.kernel.org/all/20261021221221.502428-1-kapoorarnav43@gmail.com/
v1 was tested in QEMU (q35, KVM) with KASAN, CONFIG_DMA_API_DEBUG and
fail_page_alloc: the syzbot reproducer no longer warns, and the emulated
vmxnet3 probes, gets link and pings, also with order>=4 allocations
failing. The code is unchanged since v1. Not tested on ESXi.
drivers/net/vmxnet3/vmxnet3_drv.c | 19 +++----------------
drivers/net/vmxnet3/vmxnet3_int.h | 1 -
2 files changed, 3 insertions(+), 17 deletions(-)1 more lines
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index f8df83f9965d..3a9fb5b63e9d 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2921,8 +2921,8 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
devRead->misc.driverInfo.vmxnet3RevSpt = cpu_to_le32(1);
devRead->misc.driverInfo.uptVerSpt = cpu_to_le32(1);
- devRead->misc.ddPA = cpu_to_le64(adapter->adapter_pa);
- devRead->misc.ddLen = cpu_to_le32(sizeof(struct vmxnet3_adapter));
+ devRead->misc.ddPA = cpu_to_le64(~0ULL);
+ devRead->misc.ddLen = cpu_to_le32(0);
/* set up feature flags */
if (adapter->netdev->features & NETIF_F_RXCSUM)
@@ -4044,14 +4044,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
}
spin_lock_init(&adapter->cmd_lock);
- adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
- sizeof(struct vmxnet3_adapter),
- DMA_TO_DEVICE);
- if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
- dev_err(&pdev->dev, "Failed to map dma\n");
- err = -EFAULT;
- goto err_set_mask;
- }
adapter->shared = dma_alloc_coherent(
&adapter->pdev->dev,
sizeof(struct Vmxnet3_DriverShared),@@ -4059,7 +4051,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
if (!adapter->shared) {
dev_err(&pdev->dev, "Failed to allocate memory\n");
err = -ENOMEM;
- goto err_alloc_shared;
+ goto err_set_mask;
}
err = vmxnet3_alloc_pci_resources(adapter);@@ -4312,9 +4304,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
dma_free_coherent(&adapter->pdev->dev,
sizeof(struct Vmxnet3_DriverShared),
adapter->shared, adapter->shared_pa);
-err_alloc_shared:
- dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
- sizeof(struct vmxnet3_adapter), DMA_TO_DEVICE);
err_set_mask:
free_netdev(netdev);
return err;
@@ -4381,8 +4370,6 @@ vmxnet3_remove_device(struct pci_dev *pdev)
dma_free_coherent(&adapter->pdev->dev,
sizeof(struct Vmxnet3_DriverShared),
adapter->shared, adapter->shared_pa);
- dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
- sizeof(struct vmxnet3_adapter), DMA_TO_DEVICE);
free_netdev(netdev);
}
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 9f24d66dbb27..2c2a446a8e4a 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -438,7 +438,6 @@ struct vmxnet3_adapter {
struct Vmxnet3_CoalesceScheme *coal_conf;
bool default_coal_mode;
- dma_addr_t adapter_pa;
dma_addr_t pm_conf_pa;
dma_addr_t rss_conf_pa;
bool queuesExtEnabled;
base-commit: 6db9448a443afde26231aaed7b112ed17b33f468
--
2.53.0