[PATCH] dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings

[PATCH] dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings

[Pranjal Shrivastava]

Prior to commit a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping
helpers"), P2P segments were mapped using the pci_p2pdma_map_segment()
helper. This helper was responsible for populating sg->dma_address,
marking the bus address, and also setting sg_dma_len(sg).

The refactor[1] removed this helper and moved the mapping logic directly
into the callers. While iommu_dma_map_sg() was correctly updated to set
the length in the new flow, it was missed in dma_direct_map_sg().

Thus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the
dma_address and marks the segment, but immediately executes 'continue',
which causes the loop to skip the standard assignment logic at the end:

    sg_dma_len(sg) = sg->length;

As a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length
field remains uninitialized (zero) for P2P bus address mappings. This
breaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len()
to determine the transfer size.

Fix this by explicitly setting the DMA length in the
PCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist
entry.

Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers")
Reported-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Pranjal Shrivastava <praan@google.com>

[1]
https://lore.kernel.org/all/ac14a0e94355bf898de65d023ccf8a2ad22a3ece.1746424934.git.leon@kernel.org/
---
 kernel/dma/direct.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
index 1f9ee9759426..f973e7e73c90 100644
--- a/kernel/dma/direct.c
+++ b/kernel/dma/direct.c
@@ -481,6 +481,7 @@ int dma_direct_map_sg(struct device *dev, struct scatterlist *sgl, int nents,
 		case PCI_P2PDMA_MAP_BUS_ADDR:
 			sg->dma_address = pci_p2pdma_bus_addr_map(&p2pdma_state,
 					sg_phys(sg));
+			sg_dma_len(sg) = sg->length;
 			sg_dma_mark_bus_address(sg);
 			continue;
 		default:
-- 
2.52.0.487.g5c8c507ade-goog

Re: [PATCH] dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings

[Logan Gunthorpe]

On 2025-11-26 04:41, Pranjal Shrivastava wrote:
> Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers")
> Reported-by: Jacob Moroni <jmoroni@google.com>
> Signed-off-by: Pranjal Shrivastava <praan@google.com>

Sad I missed that. Nice catch, thanks.

Reviewed-by: Logan Gunthorpe <logang@deltatee.com>

Re: [PATCH] dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings

[Leon Romanovsky]

On Wed, Nov 26, 2025 at 11:41:12AM +0000, Pranjal Shrivastava wrote:
> Prior to commit a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping
> helpers"), P2P segments were mapped using the pci_p2pdma_map_segment()
> helper. This helper was responsible for populating sg->dma_address,
> marking the bus address, and also setting sg_dma_len(sg).
> 
> The refactor[1] removed this helper and moved the mapping logic directly
> into the callers. While iommu_dma_map_sg() was correctly updated to set
> the length in the new flow, it was missed in dma_direct_map_sg().
> 
> Thus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the
> dma_address and marks the segment, but immediately executes 'continue',
> which causes the loop to skip the standard assignment logic at the end:
> 
>     sg_dma_len(sg) = sg->length;
> 
> As a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length
> field remains uninitialized (zero) for P2P bus address mappings. This
> breaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len()
> to determine the transfer size.
> 
> Fix this by explicitly setting the DMA length in the
> PCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist
> entry.
> 
> Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers")
> Reported-by: Jacob Moroni <jmoroni@google.com>
> Signed-off-by: Pranjal Shrivastava <praan@google.com>
> 
> [1]
> https://lore.kernel.org/all/ac14a0e94355bf898de65d023ccf8a2ad22a3ece.1746424934.git.leon@kernel.org/
> ---
>  kernel/dma/direct.c | 1 +
>  1 file changed, 1 insertion(+)
> 

Thanks,
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>

Re: [PATCH] dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings

[Shivaji Kant]

On Wed, Nov 26, 2025 at 10:45 PM Leon Romanovsky <leon@kernel.org> wrote:
>
> On Wed, Nov 26, 2025 at 11:41:12AM +0000, Pranjal Shrivastava wrote:
> > Prior to commit a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping
> > helpers"), P2P segments were mapped using the pci_p2pdma_map_segment()
> > helper. This helper was responsible for populating sg->dma_address,
> > marking the bus address, and also setting sg_dma_len(sg).
> >
> > The refactor[1] removed this helper and moved the mapping logic directly
> > into the callers. While iommu_dma_map_sg() was correctly updated to set
> > the length in the new flow, it was missed in dma_direct_map_sg().
> >
> > Thus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the
> > dma_address and marks the segment, but immediately executes 'continue',
> > which causes the loop to skip the standard assignment logic at the end:
> >
> >     sg_dma_len(sg) = sg->length;
> >
> > As a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length
> > field remains uninitialized (zero) for P2P bus address mappings. This
> > breaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len()
> > to determine the transfer size.
> >
> > Fix this by explicitly setting the DMA length in the
> > PCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist
> > entry.
> >
> > Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers")
> > Reported-by: Jacob Moroni <jmoroni@google.com>
> > Signed-off-by: Pranjal Shrivastava <praan@google.com>
> >
> > [1]
> > https://lore.kernel.org/all/ac14a0e94355bf898de65d023ccf8a2ad22a3ece.1746424934.git.leon@kernel.org/
> > ---
> >  kernel/dma/direct.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
>
> Thanks,
> Reviewed-by: Leon Romanovsky <leonro@nvidia.com>

Thanks,
Reviewed-by: Shivaji Kant <shivajikant@google.com>

Re: [PATCH] dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings

[Marek Szyprowski]

On 26.11.2025 12:41, Pranjal Shrivastava wrote:
> Prior to commit a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping
> helpers"), P2P segments were mapped using the pci_p2pdma_map_segment()
> helper. This helper was responsible for populating sg->dma_address,
> marking the bus address, and also setting sg_dma_len(sg).
>
> The refactor[1] removed this helper and moved the mapping logic directly
> into the callers. While iommu_dma_map_sg() was correctly updated to set
> the length in the new flow, it was missed in dma_direct_map_sg().
>
> Thus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the
> dma_address and marks the segment, but immediately executes 'continue',
> which causes the loop to skip the standard assignment logic at the end:
>
>      sg_dma_len(sg) = sg->length;
>
> As a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length
> field remains uninitialized (zero) for P2P bus address mappings. This
> breaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len()
> to determine the transfer size.
>
> Fix this by explicitly setting the DMA length in the
> PCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist
> entry.
>
> Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers")
> Reported-by: Jacob Moroni <jmoroni@google.com>
> Signed-off-by: Pranjal Shrivastava <praan@google.com>

Applied to dma-mapping-fixes. Thanks!

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland