[PATCH 0/2] block, nvme: minor fixes to dma-buf support

[PATCH 0/2] block, nvme: minor fixes to dma-buf support

[Keith Busch]

From: Keith Busch <kbusch@kernel.org>

Just a couple minor fixes. I wish I could say I caught the first one
myself, but no, I prompted an LLM to look at it.

I am assuming changing the bi_offset type to accomodate large offsets
isn't acceptable as the bvec_iter's size appears to be packed to be
small. I think there's a path to accepting larger offsets through
bi_idx, but the patch proposed here is a safer quick fix.

Keith Busch (2):
  block: reject dma-bufs larger than 4GiB
  nvme-pci: detach dma-bufs only on removal

 block/fops.c            | 4 ++++
 drivers/nvme/host/pci.c | 4 +---
 2 files changed, 5 insertions(+), 3 deletions(-)

-- 
2.52.0

[PATCH 1/2] block: reject dma-bufs larger than 4GiB

[Keith Busch]

From: Keith Busch <kbusch@kernel.org>

The dma-buf offset is set in the 32-bit bvec_iter bi_offset. Reject
buffers that can carry an offset that would wrap.

Fixes: 839231d19393 ("block: add dma-buf support for raw bdev")
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
 block/fops.c | 3 ++++
 1 file changed, 3 insertions(+)

diff --git a/block/fops.c b/block/fops.c
index 46cb86dd36d23..a974b423869eb 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -19,6 +19,7 @@
 #include <linux/iomap.h>
 #include <linux/module.h>
 #include <linux/io_uring/cmd.h>
+#include <linux/dma-buf-io.h>
 #include "blk.h"
 
 static inline struct inode *bdev_file_inode(struct file *file)
@@ -1009,6 +1010,9 @@ static int blkdev_init_dma_buf_io_ctx(struct file *file,
 
 	if (!(file->f_flags & O_DIRECT))
 		return -EINVAL;
+	if (ctx->dmabuf->size > UINT_MAX)
+		return -EINVAL;
 	if (!disk->fops->init_dma_buf_io_ctx)
 		return -EOPNOTSUPP;
 	if (bdev_has_integrity_csum(bdev))
-- 
2.52.0

[PATCH 2/2] nvme-pci: detach dma-bufs only on removal

[Keith Busch]

From: Keith Busch <kbusch@kernel.org>

Detaching the dma-bufs on every shutdown permanently prevents dma-buf
I/O after resuming from a suspend. The mappings remain valid across
suspend, so detach these only when the device is being removed.

Fixes: ce5e386c1108 ("nvme-pci: implement dma-buf backed requests")
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
 drivers/nvme/host/pci.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9610e1ff98a2d..a29de6e520b29 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3578,9 +3578,6 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
 			nvme_unquiesce_admin_queue(&dev->ctrl);
 	}
 	mutex_unlock(&dev->shutdown_lock);
-
-	if (shutdown)
-		nvme_pci_remove_dmabuf(&dev->dmabufs);
 }
 
 static int nvme_disable_prepare_reset(struct nvme_dev *dev, bool shutdown)
@@ -4150,6 +4147,7 @@ static void nvme_remove(struct pci_dev *pdev)
 	nvme_stop_ctrl(&dev->ctrl);
 	nvme_remove_namespaces(&dev->ctrl);
 	nvme_dev_disable(dev, true);
+	nvme_pci_remove_dmabuf(&dev->dmabufs);
 	nvme_free_host_mem(dev);
 	nvme_dev_remove_admin(dev);
 	nvme_dbbuf_dma_free(dev);
-- 
2.52.0

Re: [PATCH 0/2] block, nvme: minor fixes to dma-buf support

[Jens Axboe]

On Wed, 21 Oct 2026 11:46:56 -0700, Keith Busch wrote:
> Just a couple minor fixes. I wish I could say I caught the first one
> myself, but no, I prompted an LLM to look at it.
> 
> I am assuming changing the bi_offset type to accomodate large offsets
> isn't acceptable as the bvec_iter's size appears to be packed to be
> small. I think there's a path to accepting larger offsets through
> bi_idx, but the patch proposed here is a safer quick fix.
> 
> [...]

Applied, thanks!

[1/2] block: reject dma-bufs larger than 4GiB
      commit: bcbd808652e127a704c21fa44d908eb56cbcda03
[2/2] nvme-pci: detach dma-bufs only on removal
      commit: fd13f31ac62abac4df2166bb0a6fbff53b288e0c

Best regards,
-- 
Jens Axboe