[PATCH net-next v2] vmxnet3: stop DMA mapping the adapter structure

[PATCH net-next v2] vmxnet3: stop DMA mapping the adapter structure

[Arnav Kapoor]

vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
dma_map_single() and passes its address to the device as the "driver
data" (misc.ddPA/ddLen) in the shared area.

The adapter is the netdev private area, and alloc_netdev_mqs() allocates
it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
and is well above PAGE_SIZE, so when a high-order allocation fails the
adapter ends up in vmalloc memory. dma_map_single() then warns
("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
and probe fails with -EFAULT. syzbot hit this with page allocation
fault injection.

The driver data is only informational. The per-queue descriptors in
this driver already report no driver data with ddPA = ~0ULL and
ddLen = 0, and other vmxnet3 drivers, such as the one in DPDK, never set
misc.ddPA at all.

Drop the mapping and report no driver data in the shared area as well.
This also removes a probe failure path and the adapter_pa field.

Reported-by: syzbot+8eed6f83440ecdaf4be6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8eed6f83440ecdaf4be6
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
Changes in v2:
- Retarget to net-next and drop the Fixes tag (Jakub)
- Drop the "never synced" part of the commit message (Jakub)
- Add Simon's Reviewed-by

v1: https://lore.kernel.org/all/20261021221221.502428-1-kapoorarnav43@gmail.com/

v1 was tested in QEMU (q35, KVM) with KASAN, CONFIG_DMA_API_DEBUG and
fail_page_alloc: the syzbot reproducer no longer warns, and the emulated
vmxnet3 probes, gets link and pings, also with order>=4 allocations
failing. The code is unchanged since v1. Not tested on ESXi.

 drivers/net/vmxnet3/vmxnet3_drv.c | 19 +++----------------
 drivers/net/vmxnet3/vmxnet3_int.h |  1 -
 2 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index f8df83f9965d..3a9fb5b63e9d 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2921,8 +2921,8 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
 	devRead->misc.driverInfo.vmxnet3RevSpt = cpu_to_le32(1);
 	devRead->misc.driverInfo.uptVerSpt = cpu_to_le32(1);
 
-	devRead->misc.ddPA = cpu_to_le64(adapter->adapter_pa);
-	devRead->misc.ddLen = cpu_to_le32(sizeof(struct vmxnet3_adapter));
+	devRead->misc.ddPA = cpu_to_le64(~0ULL);
+	devRead->misc.ddLen = cpu_to_le32(0);
 
 	/* set up feature flags */
 	if (adapter->netdev->features & NETIF_F_RXCSUM)
@@ -4044,14 +4044,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 	}
 
 	spin_lock_init(&adapter->cmd_lock);
-	adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
-					     sizeof(struct vmxnet3_adapter),
-					     DMA_TO_DEVICE);
-	if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
-		dev_err(&pdev->dev, "Failed to map dma\n");
-		err = -EFAULT;
-		goto err_set_mask;
-	}
 	adapter->shared = dma_alloc_coherent(
 				&adapter->pdev->dev,
 				sizeof(struct Vmxnet3_DriverShared),
@@ -4059,7 +4051,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 	if (!adapter->shared) {
 		dev_err(&pdev->dev, "Failed to allocate memory\n");
 		err = -ENOMEM;
-		goto err_alloc_shared;
+		goto err_set_mask;
 	}
 
 	err = vmxnet3_alloc_pci_resources(adapter);
@@ -4312,9 +4304,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 	dma_free_coherent(&adapter->pdev->dev,
 			  sizeof(struct Vmxnet3_DriverShared),
 			  adapter->shared, adapter->shared_pa);
-err_alloc_shared:
-	dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
-			 sizeof(struct vmxnet3_adapter), DMA_TO_DEVICE);
 err_set_mask:
 	free_netdev(netdev);
 	return err;
@@ -4381,8 +4370,6 @@ vmxnet3_remove_device(struct pci_dev *pdev)
 	dma_free_coherent(&adapter->pdev->dev,
 			  sizeof(struct Vmxnet3_DriverShared),
 			  adapter->shared, adapter->shared_pa);
-	dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
-			 sizeof(struct vmxnet3_adapter), DMA_TO_DEVICE);
 	free_netdev(netdev);
 }
 
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 9f24d66dbb27..2c2a446a8e4a 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -438,7 +438,6 @@ struct vmxnet3_adapter {
 	struct Vmxnet3_CoalesceScheme *coal_conf;
 	bool   default_coal_mode;
 
-	dma_addr_t adapter_pa;
 	dma_addr_t pm_conf_pa;
 	dma_addr_t rss_conf_pa;
 	bool   queuesExtEnabled;

base-commit: 6db9448a443afde26231aaed7b112ed17b33f468
-- 
2.53.0

Re: [PATCH net-next v2] vmxnet3: stop DMA mapping the adapter structure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 10 Nov 2026 21:10:29 +0530 you wrote:
> vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
> dma_map_single() and passes its address to the device as the "driver
> data" (misc.ddPA/ddLen) in the shared area.
> 
> The adapter is the netdev private area, and alloc_netdev_mqs() allocates
> it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
> and is well above PAGE_SIZE, so when a high-order allocation fails the
> adapter ends up in vmalloc memory. dma_map_single() then warns
> ("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
> and probe fails with -EFAULT. syzbot hit this with page allocation
> fault injection.
> 
> [...]

Here is the summary with links:
  - [net-next,v2] vmxnet3: stop DMA mapping the adapter structure
    https://git.kernel.org/netdev/net-next/c/42abea827cf2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html