[PATCH] powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

[PATCH] powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

[Thorsten Blum]

If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path
decrements iopage but keeps using the failed mapping's offset. As a
result, it repeatedly tries to invalidate the failed IOPTE slot and
leaves the already installed IOPTEs valid.

Recompute offset and invalidate the installed IOPTEs instead.

Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 arch/powerpc/platforms/ps3/mm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
index 20fc5b68faee..315a32fd75b1 100644
--- a/arch/powerpc/platforms/ps3/mm.c
+++ b/arch/powerpc/platforms/ps3/mm.c
@@ -615,6 +615,7 @@ static int dma_ioc0_map_pages(struct ps3_dma_region *r, unsigned long phys_addr,
 
 fail_map:
 	for (iopage--; 0 <= iopage; iopage--) {
+		offset = (1 << r->page_size) * iopage;
 		lv1_put_iopte(0,
 			      c->bus_addr + offset,
 			      c->lpar_addr + offset,

Re: [PATCH] powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

[Geert Uytterhoeven]

On Sat, 11 Jul 2026 at 15:10, Thorsten Blum <thorsten.blum@linux.dev> wrote:
> If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path
> decrements iopage but keeps using the failed mapping's offset. As a
> result, it repeatedly tries to invalidate the failed IOPTE slot and
> leaves the already installed IOPTEs valid.
>
> Recompute offset and invalidate the installed IOPTEs instead.
>
> Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>

Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH] powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

[Ritesh Harjani]

Thorsten Blum <thorsten.blum@linux.dev> writes:

> If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path
> decrements iopage but keeps using the failed mapping's offset. As a
> result, it repeatedly tries to invalidate the failed IOPTE slot and
> leaves the already installed IOPTEs valid.
>
> Recompute offset and invalidate the installed IOPTEs instead.
>

Nice catch! I wonder how did you catch this?
Do you have ps3 console where you somehow ran into this ;)
Or was it a manual inspection?
I wonder whether PS3 consoles are still being used?

> Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework")

Looks like this was from 2007.

However, the change looks good to me. So:
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>


> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
>  arch/powerpc/platforms/ps3/mm.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
> index 20fc5b68faee..315a32fd75b1 100644
> --- a/arch/powerpc/platforms/ps3/mm.c
> +++ b/arch/powerpc/platforms/ps3/mm.c
> @@ -615,6 +615,7 @@ static int dma_ioc0_map_pages(struct ps3_dma_region *r, unsigned long phys_addr,
>  
>  fail_map:
>  	for (iopage--; 0 <= iopage; iopage--) {
> +		offset = (1 << r->page_size) * iopage;
>  		lv1_put_iopte(0,
>  			      c->bus_addr + offset,
>  			      c->lpar_addr + offset,

Re: [PATCH] powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

[Thorsten Blum]

On Mon, Jul 13, 2026 at 06:08:56PM +0530, Ritesh Harjani wrote:
> Thorsten Blum <thorsten.blum@linux.dev> writes:
> 
> > If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path
> > decrements iopage but keeps using the failed mapping's offset. As a
> > result, it repeatedly tries to invalidate the failed IOPTE slot and
> > leaves the already installed IOPTEs valid.
> >
> > Recompute offset and invalidate the installed IOPTEs instead.
> >
> 
> Nice catch! I wonder how did you catch this?
> Do you have ps3 console where you somehow ran into this ;)
> Or was it a manual inspection?

I do have a PS3 somewhere, but I stumbled upon this while reading and
trying to understand the code.

> I wonder whether PS3 consoles are still being used?

Not sure.

> > Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework")
> 
> Looks like this was from 2007.
> 
> However, the change looks good to me. So:
> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>

Thanks,
Thorsten

Re: [PATCH] powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()

[Florian Fuchs]

On 13 Jul 17:08, Thorsten Blum wrote:
> On Mon, Jul 13, 2026 at 06:08:56PM +0530, Ritesh Harjani wrote:
> > Thorsten Blum <thorsten.blum@linux.dev> writes:
> > 
> > > If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path
> > > decrements iopage but keeps using the failed mapping's offset. As a
> > > result, it repeatedly tries to invalidate the failed IOPTE slot and
> > > leaves the already installed IOPTEs valid.
> > >
> > > Recompute offset and invalidate the installed IOPTEs instead.
> > >
> > 
> > Nice catch! I wonder how did you catch this?
> > Do you have ps3 console where you somehow ran into this ;)
> > Or was it a manual inspection?
> 
> I do have a PS3 somewhere, but I stumbled upon this while reading and
> trying to understand the code.
> 
> > I wonder whether PS3 consoles are still being used?
> 
> Not sure.
> 

Yes, indeed, they are :-) But I'm not sure on how to test or inject the
error path, so I can't add anything useful to that. Beside, thanks for
keeping an eye on the good stuff.

> > > Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework")
> > 
> > Looks like this was from 2007.
> > 
> > However, the change looks good to me. So:
> > Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> 
> Thanks,
> Thorsten
> 

Regards,
Florian