From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CE5944D6AB; Thu, 30 Jul 2026 16:13:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785427997; cv=none; b=an6ysXGBNibDsI/UXyxJa6XRgDZPmOrYrh/9lXUMOzM2Wsky2mTmuyR8IafFCcxamoHp4EPBpvfoHvVNDkY5mptcrz5sFbe8k1OftR0QDeJQH4MW63U/B4WBkvWI07iIQYL+e+sN0HIZm+gdZ5XJ+H1cMEm86Y9ZhbZ9O0JlUko= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785427997; c=relaxed/simple; bh=Mt31lpTWG/2ay//+7PE3bTS/P0ANAF7Iy6DqiktYfmk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=koNB8smmBZ7JL5XcEmusl0nq2wYUqejOLHTcjPNLMimMkZL4J+ws8SPKEoJLLTFLyTb8fPwP5SNYzXXBkHvGXx5n41ChJlYlcMvLXFsN4apxpSyCZi1Off/lTQpDcm9TaQFYBa+GUAYvOwy/GDjP4tD4o2FekfIx86oaGLlUgjU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fHhBZw8l; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="fHhBZw8l" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D49551F000E9; Thu, 30 Jul 2026 16:13:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785427996; bh=6PmDh/BbjpKIXSMlSjhnlv5VO5RHOIdaOfj02V7JU8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fHhBZw8lgzH5Z8VGeSudHJwKzJvWVkL+7iDx3ce7D6jzLjlTIYld56on6AsG+D/mE AUT70/LtNNGE7D0oVx29HwtsuGyJMdUqQjkuJPMHhTGHIenhuOxS5kpgBI6BkPfZqX xgk5VVRPJNDxXTre+8P93dZWWLAh5QnrSlw42swk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Julian Orth , Jason Gunthorpe , Vivek Kasireddy , Sasha Levin Subject: [PATCH 6.6 365/484] udmabuf: Do not create malformed scatterlists Date: Thu, 30 Jul 2026 16:14:22 +0200 Message-ID: <20260730141431.402681730@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141423.392222816@linuxfoundation.org> References: <20260730141423.392222816@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jason Gunthorpe [ Upstream commit 5bf888673e0dda5a53220fa0c4956271a46c353c ] Using a sg_set_folio() loop for every 4K results in a malformed scatterlist because sg_set_folio() has an issue with offsets > PAGE_SIZE and because scatterlist expects the creator to build a list which consolidates any physical contiguity. sg_alloc_table_from_pages() creates a valid scatterlist directly from a struct page array, so go back to that. Remove the offsets allocation and just store an array of tail pages as it did before the below commit. Everything wants that anyhow. Fixes: 0c8b91ef5100 ("udmabuf: add back support for mapping hugetlb pages") Reported-by: Julian Orth Closes: https://lore.kernel.org/all/20260308-scatterlist-v1-1-39c4566b0bba@gmail.com/ Signed-off-by: Jason Gunthorpe Reviewed-by: Vivek Kasireddy Signed-off-by: Vivek Kasireddy Link: https://patch.msgid.link/0-v1-42779f29381a+4b9-udmabuf_sg_jgg@nvidia.com Stable-dep-of: 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/dma-buf/udmabuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -100,14 +100,16 @@ static struct sg_table *get_sg_table(str 0, ubuf->pagecount << PAGE_SHIFT, GFP_KERNEL); if (ret < 0) - goto err; + goto err_alloc; + ret = dma_map_sgtable(dev, sg, direction, 0); if (ret < 0) - goto err; + goto err_map; return sg; -err: +err_map: sg_free_table(sg); +err_alloc: kfree(sg); return ERR_PTR(ret); }