From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E582D33F59D for ; Sun, 9 Aug 2026 03:35:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786246518; cv=none; b=ta3ZRVwT4r1j6gcAaIwEdVguAkXHhY0ruQNGtGUzmRF/+mFv+BlDNiabEECpe8GBeYqfGsOG2NjWTWg0iaR/4Ggx4oOY/iQv0QqLTQWhJ2ldC6ZWZMfLjLv2rgIBjKSHpIH44jpx2hqqqVVIbiCeuKjeaej2sfugf6ACKI8m3v4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786246518; c=relaxed/simple; bh=qDd5025ltkx2plAraA4GXZjTXOJCqNrVwmJ/X9vWV6o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YecjKqZE4PBawdFhkZglip/O1O1JVxw3E40keLchNQe4qgGY7R8LhtXJ1TOi6Jaie+Ef3mJDaipvLvwbSRmvnVFPKchQRgzFy7N6d2AuPRaZoczJgeX3MRLCfQ8odUwEfGfELNPyt/VWaTJwzgvpiyk2b35P1wDLjdcG/G1cQhw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XBCKBQq4; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XBCKBQq4" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-ca97d139d5fso673117a12.0 for ; Sat, 08 Aug 2026 20:35:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786246516; x=1786851316; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=99aSv3oQy8bBTbpm4SMRqbPI3qurgIZlhYbHmHdiDcY=; b=XBCKBQq4/okku4y52NznRByuFaWWRGjRZUcrfu9QvplFYBpYnTPykO7FKOO0P3iF1g JDIjJ8YcGQfzq7EAsNMFrgvS3flNbuhpskIs8EEFONhezfV/9v3oOFTgKgcve6uLvrTL q6jYyNOFqHHrOl+ihvmPzk3eZ9P95K0UqaAJvK8FYT15XRq6JlVv9vrKOnOuao/+aLpd H6M54RberXl6ds4WUqfnMxSD9IRrjSYcCG+Fwu7sxzOCoHXfoSaMDTflP1Dvgo6igCNc +3MH1PeYUtcZ6UenkVUpKfwJiaDE8ktl/xZIccCbAbssF4bIcwaFDaGismJYlJnDzxa+ oS4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786246516; x=1786851316; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=99aSv3oQy8bBTbpm4SMRqbPI3qurgIZlhYbHmHdiDcY=; b=anPMYBmhAbfUnZGWto0/Sm6sYQsm9loA73q0lc0MalgrmDOf5C20io2rGqCwtRVBjx ltVndpILQ6RVzaXBZ8FCKdk9Kn7LMsCDHYoMxPbWaIfJElsZ6VEfVpLBy174BA7VdsJE skytmuI80rIk5VPNku8AYDD4RIXB1TtJsObdlSrsx+fO9dhSOH7lbvrc8c+CRXRrpDMj bddE1q7ZDdSrug8A0BHsWA508locGT93eqx101yVnAC2HcOAQAgNxwZlzE9NCFga7J6C MpzWlBTuLCHxNTc1/9RB9L4Cex1eK6tFb2u45DcaEdnX5Ahkh+s5G+Zvx6yqi5Sm7C33 gIbg== X-Forwarded-Encrypted: i=1; AHgh+RrfHrT5MtsgwkkzcZRitpS03OtjnUtvigiS6fRp/Y8d+d8KgMk3OuOK77ywTCVBZHYvLahpFQwXzXOZILk=@vger.kernel.org X-Gm-Message-State: AOJu0YxKOoDaK4/4D6rwDWm5v1c8TYrNI7eGfEGxCv1ipMw0CyExMuf4 IKj9snFOmjUrf1z4akBLbxLlEkqt03VzheIsNN0ustx1Nsrxx14+K+Rt X-Gm-Gg: AR+sD12jmWnOiiNmqLV9jU5lEV+WrnFVeRbfwouvuMPLQa56cKH4mnjpUFo/y2FLPm3 DHdbezlnZb+bPdQ1rVW5pCx3DAIELTrIv02RUO8kSIKC6qpvc8rG9T7SMChWxcC8ZphQc6C8Xnl td6J9x7bRalo85/LBGIgI+k8IVZAhzLOCR4W7UY+R3lRN3IpeI35oyXrGQrGyT9vrWWjmI1k2Za c0814vcaYaxnVWA+Fdkq7QpqaDojwIIA4UVKcn+RSJyjmS5tValzsNLzAmK5MnA4iTbEovJ1Nd6 Wg+fUE64hXtu0Qy5uOhAEXTtT9FtnqLGz0jngLtnym8YTwK2OMIfsqVJetmEqpGQiVAmTNCUDpa yto1rTVOej79JDGxzqzzs25jsDmx0/ZKiGRMZ91sT/SO7/253NFiDu9NdDy9o9VARIdNxgYHdIU GEgfuCtGvSdB3tcl9WyzVR+G2Qhn8tpjTPUIhMUHJE4J22SyG8OkPmgXIUHue43xcV0UqjZijNQ iPDmTzZ/QxGWDCX/e4i6UNuBMiQlSJ5uu6aOcO9aCT5Vs0LDJmF/5YC9DZz X-Received: by 2002:a05:6a20:a10a:b0:3c4:3ada:384d with SMTP id adf61e73a8af0-3cb85f42d97mr35710340637.30.1786246516041; Sat, 08 Aug 2026 20:35:16 -0700 (PDT) Received: from bloom.localdomain ([2604:3d09:178e:e100::6868]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe8f1aa50esm2531160a12.9.2026.08.08.20.35.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 20:35:15 -0700 (PDT) From: Ivy Lopez To: aacraid@microsemi.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Ivy Lopez Subject: [PATCH] scsi: aacraid: fix DMA mapping leak in aac_send_raw_srb() Date: Sat, 8 Aug 2026 21:34:49 -0600 Message-ID: <20260809033449.286233-1-skunkolee@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit aac_send_raw_srb() maps each scatter/gather entry for DMA via dma_map_single() across five separate code paths, depending on the adapter type and SG format (native HBA, 64-bit host SG, 32-bit host SG, and two legacy formats). None of these mappings are ever undone: there is no dma_unmap_single() call anywhere in the file, on the success path or any of the error paths that funnel through the single cleanup label. Every FSACTL_SEND_RAW_SRB ioctl that submits at least one SG entry therefore leaks that many DMA mappings permanently. Under an IOMMU or SWIOTLB this is a genuinely exhaustible resource: sustained use (e.g. periodic smartctl -d aacraid,... polling) eventually drives new DMA mappings to fail, surfacing as intermittent I/O failures (aac_fib_send failing with -ENOMEM) and, left long enough, adapter resets and system instability. Fix this by tracking the DMA address returned from each of the five dma_map_single() calls in a new per-entry array (sg_addr[]), zero initialized alongside the existing sg_list[] array. In cleanup, unmap each entry before freeing its backing memory, using the sg_addr[i] != 0 check as a guard: some cleanup paths are reached after sg_indx has been advanced for entry i but before that entry's dma_map_single() call runs (e.g. a copy_from_user() failure), so not every index in the cleanup loop was actually mapped. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220504 Signed-off-by: Ivy Lopez --- drivers/scsi/aacraid/commctrl.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index bd82aeb679ae..d4dffd6f8af0 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -492,6 +492,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) u32 data_dir; void __user *sg_user[HBA_MAX_SG_EMBEDDED]; void *sg_list[HBA_MAX_SG_EMBEDDED]; + dma_addr_t sg_addr[HBA_MAX_SG_EMBEDDED]; u32 sg_count[HBA_MAX_SG_EMBEDDED]; u32 sg_indx = 0; u32 byte_count = 0; @@ -517,6 +518,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) } memset(sg_list, 0, sizeof(sg_list)); /* cleanup may take issue */ + memset(sg_addr, 0, sizeof(sg_addr)); /* mark all entries unmapped */ if(copy_from_user(&fibsize, &user_srb->count,sizeof(u32))){ dprintk((KERN_DEBUG"aacraid: Could not copy data size from user\n")); rcode = -EFAULT; @@ -690,6 +692,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) } addr = dma_map_single(&dev->pdev->dev, p, sg_count[i], data_dir); + sg_addr[i] = addr; hbacmd->sge[i].addr_hi = cpu_to_le32((u32)(addr>>32)); hbacmd->sge[i].addr_lo = cpu_to_le32( (u32)(addr & 0xffffffff)); @@ -752,7 +755,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) } addr = dma_map_single(&dev->pdev->dev, p, sg_count[i], data_dir); - + sg_addr[i] = addr; psg->sg[i].addr[0] = cpu_to_le32(addr & 0xffffffff); psg->sg[i].addr[1] = cpu_to_le32(addr>>32); byte_count += sg_count[i]; @@ -808,7 +811,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) } addr = dma_map_single(&dev->pdev->dev, p, sg_count[i], data_dir); - + sg_addr[i] = addr; psg->sg[i].addr[0] = cpu_to_le32(addr & 0xffffffff); psg->sg[i].addr[1] = cpu_to_le32(addr>>32); byte_count += sg_count[i]; @@ -865,7 +868,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) addr = dma_map_single(&dev->pdev->dev, p, usg->sg[i].count, data_dir); - + sg_addr[i] = addr; psg->sg[i].addr = cpu_to_le32(addr & 0xffffffff); byte_count += usg->sg[i].count; psg->sg[i].count = cpu_to_le32(sg_count[i]); @@ -905,7 +908,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) } addr = dma_map_single(&dev->pdev->dev, p, sg_count[i], data_dir); - + sg_addr[i] = addr; psg->sg[i].addr = cpu_to_le32(addr); byte_count += sg_count[i]; psg->sg[i].count = cpu_to_le32(sg_count[i]); @@ -986,8 +989,12 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) cleanup: kfree(user_srbcmd); if (rcode != -ERESTARTSYS) { - for (i = 0; i <= sg_indx; i++) + for (i = 0; i <= sg_indx; i++) { + if (sg_addr[i]) + dma_unmap_single(&dev->pdev->dev, sg_addr[i], + sg_count[i], data_dir); kfree(sg_list[i]); + } aac_fib_complete(srbfib); aac_fib_free(srbfib); } -- 2.55.0