[PATCH 0/5] bitmap: align bitmap_find_next_zero_area_off() output with the rest of the API

[PATCH 0/5] bitmap: align bitmap_find_next_zero_area_off() output with the rest of the API

[Yury Norov]

Bitmap search functions return a value greater than or equal to nbits when
no suitable bits are found. bitmap_find_next_zero_area_off() is an
exception: it returns a value greater than nbits.

Align the function with the rest of the API and adjust the affected callers
accordingly.

Patches 1-4 are sent only to their respective maintainers and mailing
lists. Patch 5 and the cover letter are sent to all recipients.

On top of -next. I plan to carry the series with bitmap-for-next.

Yury Norov (5):
  ARM: dma-mapping: Treat bitmap size as allocation failure
  powerpc/msi: Treat bitmap size as allocation failure
  crypto: ccp: Treat bitmap size as allocation failure
  media: s5p-mfc: Treat bitmap size as allocation failure
  bitmap: Return size when no zero area is found

 arch/arm/mm/dma-mapping.c                            |  4 ++--
 arch/powerpc/sysdev/msi_bitmap.c                     |  2 +-
 drivers/crypto/ccp/ccp-dev-v3.c                      |  2 +-
 drivers/crypto/ccp/ccp-dev-v5.c                      |  6 +++---
 drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c |  2 +-
 include/linux/bitmap.h                               |  3 +++
 lib/bitmap.c                                         | 10 ++++------
 7 files changed, 15 insertions(+), 14 deletions(-)

-- 
2.53.0

[PATCH 1/5] ARM: dma-mapping: Treat bitmap size as allocation failure

[Yury Norov]

bitmap_find_next_zero_area() uses an out-of-range return value to
indicate failure. Check for values greater than or equal to the bitmap
size so the caller does not depend on the exact failure sentinel.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
 arch/arm/mm/dma-mapping.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f9bc53b60f99..7761099dde9e 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -773,7 +773,7 @@ static inline dma_addr_t __alloc_iova(struct dma_iommu_mapping *mapping,
 		start = bitmap_find_next_zero_area(mapping->bitmaps[i],
 				mapping->bits, 0, count, align);
 
-		if (start > mapping->bits)
+		if (start >= mapping->bits)
 			continue;
 
 		bitmap_set(mapping->bitmaps[i], start, count);
@@ -794,7 +794,7 @@ static inline dma_addr_t __alloc_iova(struct dma_iommu_mapping *mapping,
 		start = bitmap_find_next_zero_area(mapping->bitmaps[i],
 				mapping->bits, 0, count, align);
 
-		if (start > mapping->bits) {
+		if (start >= mapping->bits) {
 			spin_unlock_irqrestore(&mapping->lock, flags);
 			return DMA_MAPPING_ERROR;
 		}
-- 
2.53.0

Re: [PATCH 1/5] ARM: dma-mapping: Treat bitmap size as allocation failure

[Marek Szyprowski]

On 09.07.2026 04:03, Yury Norov wrote:
> bitmap_find_next_zero_area() uses an out-of-range return value to
> indicate failure. Check for values greater than or equal to the bitmap
> size so the caller does not depend on the exact failure sentinel.
>
> Signed-off-by: Yury Norov <ynorov@nvidia.com>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
>  arch/arm/mm/dma-mapping.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
> index f9bc53b60f99..7761099dde9e 100644
> --- a/arch/arm/mm/dma-mapping.c
> +++ b/arch/arm/mm/dma-mapping.c
> @@ -773,7 +773,7 @@ static inline dma_addr_t __alloc_iova(struct dma_iommu_mapping *mapping,
>  		start = bitmap_find_next_zero_area(mapping->bitmaps[i],
>  				mapping->bits, 0, count, align);
>  
> -		if (start > mapping->bits)
> +		if (start >= mapping->bits)
>  			continue;
>  
>  		bitmap_set(mapping->bitmaps[i], start, count);
> @@ -794,7 +794,7 @@ static inline dma_addr_t __alloc_iova(struct dma_iommu_mapping *mapping,
>  		start = bitmap_find_next_zero_area(mapping->bitmaps[i],
>  				mapping->bits, 0, count, align);
>  
> -		if (start > mapping->bits) {
> +		if (start >= mapping->bits) {
>  			spin_unlock_irqrestore(&mapping->lock, flags);
>  			return DMA_MAPPING_ERROR;
>  		}

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland

[PATCH 2/5] powerpc/msi: Treat bitmap size as allocation failure

[Yury Norov]

bitmap_find_next_zero_area() uses an out-of-range return value to
indicate failure. Check for values greater than or equal to the bitmap
size so the caller does not depend on the exact failure sentinel.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
 arch/powerpc/sysdev/msi_bitmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/sysdev/msi_bitmap.c b/arch/powerpc/sysdev/msi_bitmap.c
index 456a4f64ae0a..2f38d4b41ad3 100644
--- a/arch/powerpc/sysdev/msi_bitmap.c
+++ b/arch/powerpc/sysdev/msi_bitmap.c
@@ -21,7 +21,7 @@ int msi_bitmap_alloc_hwirqs(struct msi_bitmap *bmp, int num)
 
 	offset = bitmap_find_next_zero_area(bmp->bitmap, bmp->irq_count, 0,
 					    num, (1 << order) - 1);
-	if (offset > bmp->irq_count)
+	if (offset >= bmp->irq_count)
 		goto err;
 
 	bitmap_set(bmp->bitmap, offset, num);
-- 
2.53.0

Re: [PATCH 2/5] powerpc/msi: Treat bitmap size as allocation failure

[Madhavan Srinivasan]

On 7/9/26 7:33 AM, Yury Norov wrote:
> bitmap_find_next_zero_area() uses an out-of-range return value to
> indicate failure. Check for values greater than or equal to the bitmap
> size so the caller does not depend on the exact failure sentinel.
Changes seems to fine.
Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>

When reviewing this, I did find the return value of 
bitmap_find_next_zero_area
to be unsigned long, but we are casting it to int. Not as concern at 
this point
this will be an issue when irq_count exceeds. May be a follow patch is 
needed
to fix this I guess.
Maddy

> Signed-off-by: Yury Norov <ynorov@nvidia.com>
> ---
>   arch/powerpc/sysdev/msi_bitmap.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/powerpc/sysdev/msi_bitmap.c b/arch/powerpc/sysdev/msi_bitmap.c
> index 456a4f64ae0a..2f38d4b41ad3 100644
> --- a/arch/powerpc/sysdev/msi_bitmap.c
> +++ b/arch/powerpc/sysdev/msi_bitmap.c
> @@ -21,7 +21,7 @@ int msi_bitmap_alloc_hwirqs(struct msi_bitmap *bmp, int num)
>   
>   	offset = bitmap_find_next_zero_area(bmp->bitmap, bmp->irq_count, 0,
>   					    num, (1 << order) - 1);
> -	if (offset > bmp->irq_count)
> +	if (offset >= bmp->irq_count)
>   		goto err;
>   
>   	bitmap_set(bmp->bitmap, offset, num);

[PATCH 3/5] crypto: ccp: Treat bitmap size as allocation failure

[Yury Norov]

bitmap_find_next_zero_area() uses an out-of-range return value to
indicate failure. Accept only offsets strictly below the bitmap size so
the callers do not depend on the exact failure sentinel.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
 drivers/crypto/ccp/ccp-dev-v3.c | 2 +-
 drivers/crypto/ccp/ccp-dev-v5.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
index fe69053b2394..60a133e23e5f 100644
--- a/drivers/crypto/ccp/ccp-dev-v3.c
+++ b/drivers/crypto/ccp/ccp-dev-v3.c
@@ -28,7 +28,7 @@ static u32 ccp_alloc_ksb(struct ccp_cmd_queue *cmd_q, unsigned int count)
 							ccp->sb_count,
 							ccp->sb_start,
 							count, 0);
-		if (start <= ccp->sb_count) {
+		if (start < ccp->sb_count) {
 			bitmap_set(ccp->sb, start, count);
 
 			mutex_unlock(&ccp->sb_mutex);
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index 7b73332d6aa1..e18ddb881bf5 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -25,6 +25,7 @@
 static u32 ccp_lsb_alloc(struct ccp_cmd_queue *cmd_q, unsigned int count)
 {
 	struct ccp_device *ccp;
+	unsigned int nbits = MAX_LSB_CNT * LSB_SIZE;
 	int start;
 
 	/* First look at the map for the queue */
@@ -43,11 +44,10 @@ static u32 ccp_lsb_alloc(struct ccp_cmd_queue *cmd_q, unsigned int count)
 	for (;;) {
 		mutex_lock(&ccp->sb_mutex);
 
-		start = (u32)bitmap_find_next_zero_area(ccp->lsbmap,
-							MAX_LSB_CNT * LSB_SIZE,
+		start = (u32)bitmap_find_next_zero_area(ccp->lsbmap, nbits,
 							0,
 							count, 0);
-		if (start <= MAX_LSB_CNT * LSB_SIZE) {
+		if (start < nbits) {
 			bitmap_set(ccp->lsbmap, start, count);
 
 			mutex_unlock(&ccp->sb_mutex);
-- 
2.53.0

[PATCH 4/5] media: s5p-mfc: Treat bitmap size as allocation failure

[Yury Norov]

bitmap_find_next_zero_area() uses an out-of-range return value to
indicate failure. Check for values greater than or equal to the bitmap
size so the caller does not depend on the exact failure sentinel.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
 drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c
index 5ba791fa3676..b25ad2a37196 100644
--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c
+++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c
@@ -43,7 +43,7 @@ int s5p_mfc_alloc_priv_buf(struct s5p_mfc_dev *dev, unsigned int mem_ctx,
 
 	if (dev->mem_virt) {
 		start = bitmap_find_next_zero_area(dev->mem_bitmap, bits, 0, count, align);
-		if (start > bits)
+		if (start >= bits)
 			goto no_mem;
 
 		bitmap_set(dev->mem_bitmap, start, count);
-- 
2.53.0

Re: [PATCH 4/5] media: s5p-mfc: Treat bitmap size as allocation failure

[Marek Szyprowski]

On 09.07.2026 04:03, Yury Norov wrote:
> bitmap_find_next_zero_area() uses an out-of-range return value to
> indicate failure. Check for values greater than or equal to the bitmap
> size so the caller does not depend on the exact failure sentinel.
>
> Signed-off-by: Yury Norov <ynorov@nvidia.com>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
>  drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c
> index 5ba791fa3676..b25ad2a37196 100644
> --- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c
> +++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c
> @@ -43,7 +43,7 @@ int s5p_mfc_alloc_priv_buf(struct s5p_mfc_dev *dev, unsigned int mem_ctx,
>  
>  	if (dev->mem_virt) {
>  		start = bitmap_find_next_zero_area(dev->mem_bitmap, bits, 0, count, align);
> -		if (start > bits)
> +		if (start >= bits)
>  			goto no_mem;
>  
>  		bitmap_set(dev->mem_bitmap, start, count);

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland

[PATCH 5/5] bitmap: Return size when no zero area is found

[Yury Norov]

Return the bitmap size, rather than size + 1, when
bitmap_find_next_zero_area_off() cannot find a suitable area. This
matches the conventional find_bit() failure sentinel and still lets
callers detect failure with an out-of-range check.

Document the public failure contract as a value greater than or equal
to the bitmap size, without requiring callers to depend on the exact
sentinel.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
 include/linux/bitmap.h |  3 +++
 lib/bitmap.c           | 10 ++++------
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
index 8854acf77869..33f175a30304 100644
--- a/include/linux/bitmap.h
+++ b/include/linux/bitmap.h
@@ -209,6 +209,9 @@ unsigned long bitmap_find_next_zero_area_off(unsigned long *map,
  * The @align_mask should be one less than a power of 2; the effect is that
  * the bit offset of all zero areas this function finds is multiples of that
  * power of 2. A @align_mask of 0 means no alignment is required.
+ *
+ * Return: The bit offset of the found area or a value >= @size
+ * if no area is found.
  */
 static __always_inline
 unsigned long bitmap_find_next_zero_area(unsigned long *map,
diff --git a/lib/bitmap.c b/lib/bitmap.c
index b464d843f4eb..ed685127a107 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -424,6 +424,9 @@ EXPORT_SYMBOL(__bitmap_clear);
  * The @align_mask should be one less than a power of 2; the effect is that
  * the bit offset of all zero areas this function finds plus @align_offset
  * is multiple of that power of 2.
+ *
+ * Return: The bit offset of the found area or a value greater than or equal
+ * to @size if no area is found.
  */
 unsigned long bitmap_find_next_zero_area_off(unsigned long *map,
 					     unsigned long size,
@@ -448,12 +451,7 @@ unsigned long bitmap_find_next_zero_area_off(unsigned long *map,
 		start = i;
 	}
 
-	/*
-	 * Here, returning size + 1 is to maintain consistency
-	 * with the old version, where the return value is always
-	 * greater than size when no zero areas are found.
-	 */
-	return size + 1;
+	return size;
 }
 EXPORT_SYMBOL(bitmap_find_next_zero_area_off);
 
-- 
2.53.0

Re: [PATCH 0/5] bitmap: align bitmap_find_next_zero_area_off() output with the rest of the API

[Yury Norov]

OK, adding in bitmap-for-next. Thanks everyone for review!

Thanks,
Yury

On Wed, Jul 08, 2026 at 10:03:06PM -0400, Yury Norov wrote:
> Bitmap search functions return a value greater than or equal to nbits when
> no suitable bits are found. bitmap_find_next_zero_area_off() is an
> exception: it returns a value greater than nbits.
> 
> Align the function with the rest of the API and adjust the affected callers
> accordingly.
> 
> Patches 1-4 are sent only to their respective maintainers and mailing
> lists. Patch 5 and the cover letter are sent to all recipients.
> 
> On top of -next. I plan to carry the series with bitmap-for-next.
> 
> Yury Norov (5):
>   ARM: dma-mapping: Treat bitmap size as allocation failure
>   powerpc/msi: Treat bitmap size as allocation failure
>   crypto: ccp: Treat bitmap size as allocation failure
>   media: s5p-mfc: Treat bitmap size as allocation failure
>   bitmap: Return size when no zero area is found
> 
>  arch/arm/mm/dma-mapping.c                            |  4 ++--
>  arch/powerpc/sysdev/msi_bitmap.c                     |  2 +-
>  drivers/crypto/ccp/ccp-dev-v3.c                      |  2 +-
>  drivers/crypto/ccp/ccp-dev-v5.c                      |  6 +++---
>  drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr.c |  2 +-
>  include/linux/bitmap.h                               |  3 +++
>  lib/bitmap.c                                         | 10 ++++------
>  7 files changed, 15 insertions(+), 14 deletions(-)
> 
> -- 
> 2.53.0