Re: [PATCH 1/2] dma-mapping: make dma_max_mapping_size() return 0 for no DMA capability

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dma_max_mapping_size() returning 0 causes division by zero in amdxdna_cbuf_map() and invalid zero-sized block layer limits in MMC drivers.
--

commit b19cb5dc0c3fd9b25263f65c9d042ee616692807
Author: John Garry <john.g.garry@oracle.com>

dma-mapping: make dma_max_mapping_size() return 0 for no DMA capability

This commit updates dma_max_mapping_size() to return 0 when a device
is not DMA capable, reflecting that the maximum mapping size for such
devices is 0.

> diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c
> index 4fe04669e5e66..7e576e5c6b8be 100644
> --- a/kernel/dma/mapping.c
> +++ b/kernel/dma/mapping.c
> @@ -979,6 +979,9 @@ size_t dma_max_mapping_size(struct device *dev)
>  	const struct dma_map_ops *ops = get_dma_ops(dev);
>  	size_t size = SIZE_MAX;
>  
> +	if (!dev->dma_mask)
> +		return 0;

[Severity: High]
Could this new return value of 0 cause a division by zero in callers that
expect a strictly positive maximum mapping size?

For instance, in drivers/accel/amdxdna/amdxdna_cbuf.c:amdxdna_cbuf_map(),
the returned size is used directly as a divisor:

        max_seg = min_t(size_t, UINT_MAX, dma_max_mapping_size(dev));
        n_entries = (cbuf->node.size + max_seg - 1) / max_seg;

If a device lacking a dma_mask maps the attachment, max_seg becomes 0,
which would result in an immediate kernel panic.

Additionally, could this cause invalid zero-sized block layer queue limits
in MMC drivers? In drivers/mmc/host/bcm2835.c:bcm2835_add_host(), the
return value clamps max_req_size:

        mmc->max_req_size = min_t(size_t, 524288, dma_max_mapping_size(dev));

If the device lacks DMA support, max_req_size becomes 0, which propagates
to the block layer and can trigger panics when processing requests.

> +
>  	if (dma_map_direct(dev, ops))
>  		size = dma_direct_max_mapping_size(dev);
>  	else if (use_dma_iommu(dev))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629085310.2298552-1-john.g.garry@oracle.com?part=1