[PATCH 6.18.y] nvme-pci: DMA unmap the correct regions in nvme_free_sgls

[PATCH 6.18.y] nvme-pci: DMA unmap the correct regions in nvme_free_sgls

[Nicolai Buchwitz]

From: Roger Pau Monne <roger.pau@citrix.com>

commit a54afbc8a2138f8c2490510cf26cde188d480c43 upstream.

The call to nvme_free_sgls() in nvme_unmap_data() has the sg_list and sge
parameters swapped.  This wasn't noticed by the compiler because both share
the same type.  On a Xen PV hardware domain, and possibly any other
architectures that takes that path, this leads to corruption of the NVMe
contents.

Fixes: f0887e2a52d4 ("nvme-pci: create common sgl unmapping helper")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
[nb: drop the attrs parameter added in 6.19 by commit 61d43b1731e0
 ("nvme-pci: migrate to dma_map_phys instead of map_page"), which is
 not in 6.18.y]
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
This hits 6.18 too: besides the known Xen PV issue, the missing fix
leads to corrupted data on NVMe disks with SGL support on BCM2712
(Raspberry Pi 5).

Reported and diagnosed in https://github.com/raspberrypi/linux/issues/7496
Backported by Phil Elwell in https://github.com/raspberrypi/linux/pull/7500

 drivers/nvme/host/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 5e36a5926fe0..8c66fd23a143 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -761,8 +761,8 @@ static void nvme_unmap_data(struct request *req)
 
 	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len)) {
 		if (nvme_pci_cmd_use_sgl(&iod->cmd))
-			nvme_free_sgls(req, iod->descriptors[0],
-				       &iod->cmd.common.dptr.sgl);
+			nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,
+				       iod->descriptors[0]);
 		else
 			nvme_free_prps(req);
 	}
-- 
2.53.0

Re: [PATCH 6.18.y] nvme-pci: DMA unmap the correct regions in nvme_free_sgls

[Keith Busch]

On Tue, Jul 14, 2026 at 10:13:42PM +0200, Nicolai Buchwitz wrote:
> From: Roger Pau Monne <roger.pau@citrix.com>
> 
> commit a54afbc8a2138f8c2490510cf26cde188d480c43 upstream.
> 
> The call to nvme_free_sgls() in nvme_unmap_data() has the sg_list and sge
> parameters swapped.  This wasn't noticed by the compiler because both share
> the same type.  On a Xen PV hardware domain, and possibly any other
> architectures that takes that path, this leads to corruption of the NVMe
> contents.
> 
> Fixes: f0887e2a52d4 ("nvme-pci: create common sgl unmapping helper")
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> Signed-off-by: Keith Busch <kbusch@kernel.org>
> [nb: drop the attrs parameter added in 6.19 by commit 61d43b1731e0
>  ("nvme-pci: migrate to dma_map_phys instead of map_page"), which is
>  not in 6.18.y]
> Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>

Yes, definitely want this for LTS.

Acked-by: Keith Busch <kbusch@kernel.org>