[PATCH] vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

[PATCH] vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

[Alex Mastro]

Remove the __iommu_unmap() call on a region that was never mapped.
When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO
modes), the region is not added to the dma_regions list, leaving its
list_head zero-initialized. If the unmap ioctl returns success,
__iommu_unmap() calls list_del_init() on this zeroed node and crashes.

This fixes the iommufd_compat_type1 and iommufd_compat_type1v2
test variants.

Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test")
Signed-off-by: Alex Mastro <amastro@fb.com>
---
The bug was missed because the test was originally run against a kernel
without commit afb47765f923 ("iommufd: Make vfio_compat's unmap succeed
if the range is already empty"). Without that fix, the unmap ioctl
returned -ENOENT, taking the early return before list_del_init().
---
 tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
index 957a89ce7b3a..d7f25ef77671 100644
--- a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
+++ b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
@@ -100,7 +100,6 @@ static void do_mmio_map_test(struct iommu *iommu,
 		iommu_unmap(iommu, &region);
 	} else {
 		VFIO_ASSERT_NE(__iommu_map(iommu, &region), 0);
-		VFIO_ASSERT_NE(__iommu_unmap(iommu, &region, NULL), 0);
 	}
 }
 

---
base-commit: 96ca4caf9066f5ebd35b561a521af588a8eb0215
change-id: 20260303-fix-mmio-test-d3bd688105f3

Best regards,
-- 
Alex Mastro <amastro@fb.com>

Re: [PATCH] vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

[Yao Yuan]

On Tue, Mar 03, 2026 at 11:46:24AM +0800, Alex Mastro wrote:
> Remove the __iommu_unmap() call on a region that was never mapped.
> When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO
> modes), the region is not added to the dma_regions list, leaving its
> list_head zero-initialized. If the unmap ioctl returns success,
> __iommu_unmap() calls list_del_init() on this zeroed node and crashes.
>
> This fixes the iommufd_compat_type1 and iommufd_compat_type1v2
> test variants.
>
> Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test")
> Signed-off-by: Alex Mastro <amastro@fb.com>
> ---
> The bug was missed because the test was originally run against a kernel
> without commit afb47765f923 ("iommufd: Make vfio_compat's unmap succeed
> if the range is already empty"). Without that fix, the unmap ioctl
> returned -ENOENT, taking the early return before list_del_init().
> ---
>  tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> index 957a89ce7b3a..d7f25ef77671 100644
> --- a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> +++ b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> @@ -100,7 +100,6 @@ static void do_mmio_map_test(struct iommu *iommu,
>  		iommu_unmap(iommu, &region);
>  	} else {

Hi Alex,

>  		VFIO_ASSERT_NE(__iommu_map(iommu, &region), 0);
> -		VFIO_ASSERT_NE(__iommu_unmap(iommu, &region, NULL), 0);

This is the more simply way to work w/ or w/o commit
afb47765f923 ("iommufd: Make vfio_compat's unmap succeed if
the range is already empty"), may worth to add this point
into the commit message.

For the changes:

Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com>

>  	}
>  }
>
>
> ---
> base-commit: 96ca4caf9066f5ebd35b561a521af588a8eb0215
> change-id: 20260303-fix-mmio-test-d3bd688105f3
>
> Best regards,
> --
> Alex Mastro <amastro@fb.com>
>

Re: [PATCH] vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

[Alex Mastro]

On Wed, Mar 04, 2026 at 08:47:15AM +0800, Yao Yuan wrote:
> On Tue, Mar 03, 2026 at 11:46:24AM +0800, Alex Mastro wrote:
> > Remove the __iommu_unmap() call on a region that was never mapped.
> > When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO
> > modes), the region is not added to the dma_regions list, leaving its
> > list_head zero-initialized. If the unmap ioctl returns success,
> > __iommu_unmap() calls list_del_init() on this zeroed node and crashes.
> >
> > This fixes the iommufd_compat_type1 and iommufd_compat_type1v2
> > test variants.
> >
> > Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test")
> > Signed-off-by: Alex Mastro <amastro@fb.com>
> > ---
> > The bug was missed because the test was originally run against a kernel
> > without commit afb47765f923 ("iommufd: Make vfio_compat's unmap succeed
> > if the range is already empty"). Without that fix, the unmap ioctl
> > returned -ENOENT, taking the early return before list_del_init().
> > ---
> >  tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c | 1 -
> >  1 file changed, 1 deletion(-)
> >
> > diff --git a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> > index 957a89ce7b3a..d7f25ef77671 100644
> > --- a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> > +++ b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> > @@ -100,7 +100,6 @@ static void do_mmio_map_test(struct iommu *iommu,
> >  		iommu_unmap(iommu, &region);
> >  	} else {
> 
> Hi Alex,
> 
> >  		VFIO_ASSERT_NE(__iommu_map(iommu, &region), 0);
> > -		VFIO_ASSERT_NE(__iommu_unmap(iommu, &region, NULL), 0);
> 
> This is the more simply way to work w/ or w/o commit
> afb47765f923 ("iommufd: Make vfio_compat's unmap succeed if
> the range is already empty"), may worth to add this point
> into the commit message.

True, but afb47765f923 was already in the vfio tree at the time the new test
was added in 080723f4d4c3. It was just (my own) negligence that I didn't run
the selftests against <current kernel>. I wrongly assumed that running the
selftests against an older kernel that I happened to have installed on my box
was good enough.

> 
> For the changes:
> 
> Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com>

Thank you!

> 
> >  	}
> >  }
> >
> >
> > ---
> > base-commit: 96ca4caf9066f5ebd35b561a521af588a8eb0215
> > change-id: 20260303-fix-mmio-test-d3bd688105f3
> >
> > Best regards,
> > --
> > Alex Mastro <amastro@fb.com>
> >

Re: [PATCH] vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

[David Matlack]

On 2026-03-03 11:46 AM, Alex Mastro wrote:
> Remove the __iommu_unmap() call on a region that was never mapped.
> When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO
> modes), the region is not added to the dma_regions list, leaving its
> list_head zero-initialized. If the unmap ioctl returns success,
> __iommu_unmap() calls list_del_init() on this zeroed node and crashes.
> 
> This fixes the iommufd_compat_type1 and iommufd_compat_type1v2
> test variants.
> 
> Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test")
> Signed-off-by: Alex Mastro <amastro@fb.com>
> ---
> The bug was missed because the test was originally run against a kernel
> without commit afb47765f923 ("iommufd: Make vfio_compat's unmap succeed
> if the range is already empty"). Without that fix, the unmap ioctl
> returned -ENOENT, taking the early return before list_del_init().

Thanks for the fix.

Looking back I remember testing your new test out without seeing a
failure. Turns out I had applied it on top of tag vfio-v6.19-rc1, which
did not have commit afb47765f923.

Reviewed-by: David Matlack <dmatlack@google.com>

Re: [PATCH] vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

[Alex Williamson]

On Tue, 3 Mar 2026 11:46:24 -0800
Alex Mastro <amastro@fb.com> wrote:

> Remove the __iommu_unmap() call on a region that was never mapped.
> When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO
> modes), the region is not added to the dma_regions list, leaving its
> list_head zero-initialized. If the unmap ioctl returns success,
> __iommu_unmap() calls list_del_init() on this zeroed node and crashes.
> 
> This fixes the iommufd_compat_type1 and iommufd_compat_type1v2
> test variants.
> 
> Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test")
> Signed-off-by: Alex Mastro <amastro@fb.com>
> ---
> The bug was missed because the test was originally run against a kernel
> without commit afb47765f923 ("iommufd: Make vfio_compat's unmap succeed
> if the range is already empty"). Without that fix, the unmap ioctl
> returned -ENOENT, taking the early return before list_del_init().
> ---
>  tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> index 957a89ce7b3a..d7f25ef77671 100644
> --- a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> +++ b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> @@ -100,7 +100,6 @@ static void do_mmio_map_test(struct iommu *iommu,
>  		iommu_unmap(iommu, &region);
>  	} else {
>  		VFIO_ASSERT_NE(__iommu_map(iommu, &region), 0);
> -		VFIO_ASSERT_NE(__iommu_unmap(iommu, &region, NULL), 0);
>  	}
>  }
>  
> 
> ---
> base-commit: 96ca4caf9066f5ebd35b561a521af588a8eb0215
> change-id: 20260303-fix-mmio-test-d3bd688105f3

Applied to vfio next branch for v7.1.  Thanks,

Alex