[PATCH net] vmxnet3: stop DMA mapping the adapter structure

[PATCH net] vmxnet3: stop DMA mapping the adapter structure

[Arnav Kapoor]

vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
dma_map_single() and passes its address to the device as the "driver
data" (misc.ddPA/ddLen) in the shared area.

The adapter is the netdev private area, and alloc_netdev_mqs() allocates
it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
and is well above PAGE_SIZE, so when a high-order allocation fails the
adapter ends up in vmalloc memory. dma_map_single() then warns
("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
and probe fails with -EFAULT. syzbot hit this with page allocation
fault injection.

The driver data is only informational: the mapping is DMA_TO_DEVICE,
done once at probe and never synced, so the device could only ever see
a stale copy. The per-queue descriptors in this driver already report
no driver data with ddPA = ~0ULL and ddLen = 0, and other vmxnet3
drivers, such as the one in DPDK, never set misc.ddPA at all.

Drop the mapping and report no driver data in the shared area as well.
This also removes a probe failure path and the adapter_pa field.

Fixes: b0eb57cb97e7 ("VMXNET3: Add support for virtual IOMMU")
Reported-by: syzbot+8eed6f83440ecdaf4be6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8eed6f83440ecdaf4be6
Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
Tested in QEMU (q35, KVM) on net/main (abeacca61eea), with KASAN,
CONFIG_DMA_API_DEBUG and fail_page_alloc (min-order=4, as in the syzbot
reproducer):

- syzbot C reproducer: before, "rejecting DMA map of vmalloc memory"
  WARNING and probe fails with -EFAULT; after, no warning (probe then
  fails at BAR mapping, as the reproducer binds vmxnet3 to a non-vmxnet3
  device).
- QEMU's emulated vmxnet3 (-device vmxnet3): probes, link up, ping
  works, before and after.
- Same NIC unbound and rebound with order>=4 page allocations failing:
  before, the WARNING and probe fails, so the NIC is gone; after, it
  binds and ping works.

No new W=1 warnings in drivers/net/vmxnet3/. Not tested on ESXi.

 drivers/net/vmxnet3/vmxnet3_drv.c | 19 +++----------------
 drivers/net/vmxnet3/vmxnet3_int.h |  1 -
 2 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index f8df83f9965d..3a9fb5b63e9d 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2921,8 +2921,8 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
 	devRead->misc.driverInfo.vmxnet3RevSpt = cpu_to_le32(1);
 	devRead->misc.driverInfo.uptVerSpt = cpu_to_le32(1);
 
-	devRead->misc.ddPA = cpu_to_le64(adapter->adapter_pa);
-	devRead->misc.ddLen = cpu_to_le32(sizeof(struct vmxnet3_adapter));
+	devRead->misc.ddPA = cpu_to_le64(~0ULL);
+	devRead->misc.ddLen = cpu_to_le32(0);
 
 	/* set up feature flags */
 	if (adapter->netdev->features & NETIF_F_RXCSUM)
@@ -4044,14 +4044,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 	}
 
 	spin_lock_init(&adapter->cmd_lock);
-	adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
-					     sizeof(struct vmxnet3_adapter),
-					     DMA_TO_DEVICE);
-	if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
-		dev_err(&pdev->dev, "Failed to map dma\n");
-		err = -EFAULT;
-		goto err_set_mask;
-	}
 	adapter->shared = dma_alloc_coherent(
 				&adapter->pdev->dev,
 				sizeof(struct Vmxnet3_DriverShared),
@@ -4059,7 +4051,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 	if (!adapter->shared) {
 		dev_err(&pdev->dev, "Failed to allocate memory\n");
 		err = -ENOMEM;
-		goto err_alloc_shared;
+		goto err_set_mask;
 	}
 
 	err = vmxnet3_alloc_pci_resources(adapter);
@@ -4312,9 +4304,6 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 	dma_free_coherent(&adapter->pdev->dev,
 			  sizeof(struct Vmxnet3_DriverShared),
 			  adapter->shared, adapter->shared_pa);
-err_alloc_shared:
-	dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
-			 sizeof(struct vmxnet3_adapter), DMA_TO_DEVICE);
 err_set_mask:
 	free_netdev(netdev);
 	return err;
@@ -4381,8 +4370,6 @@ vmxnet3_remove_device(struct pci_dev *pdev)
 	dma_free_coherent(&adapter->pdev->dev,
 			  sizeof(struct Vmxnet3_DriverShared),
 			  adapter->shared, adapter->shared_pa);
-	dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
-			 sizeof(struct vmxnet3_adapter), DMA_TO_DEVICE);
 	free_netdev(netdev);
 }
 
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 9f24d66dbb27..2c2a446a8e4a 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -438,7 +438,6 @@ struct vmxnet3_adapter {
 	struct Vmxnet3_CoalesceScheme *coal_conf;
 	bool   default_coal_mode;
 
-	dma_addr_t adapter_pa;
 	dma_addr_t pm_conf_pa;
 	dma_addr_t rss_conf_pa;
 	bool   queuesExtEnabled;

base-commit: abeacca61eea4f6803df4a595b656ea45c2d3249
-- 
2.53.0

Re: [PATCH net] vmxnet3: stop DMA mapping the adapter structure

[Simon Horman]

On Thu, Oct 22, 2026 at 03:42:12AM +0530, Arnav Kapoor wrote:
> vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
> dma_map_single() and passes its address to the device as the "driver
> data" (misc.ddPA/ddLen) in the shared area.
> 
> The adapter is the netdev private area, and alloc_netdev_mqs() allocates
> it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
> and is well above PAGE_SIZE, so when a high-order allocation fails the
> adapter ends up in vmalloc memory. dma_map_single() then warns
> ("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
> and probe fails with -EFAULT. syzbot hit this with page allocation
> fault injection.
> 
> The driver data is only informational: the mapping is DMA_TO_DEVICE,
> done once at probe and never synced, so the device could only ever see
> a stale copy. The per-queue descriptors in this driver already report
> no driver data with ddPA = ~0ULL and ddLen = 0, and other vmxnet3
> drivers, such as the one in DPDK, never set misc.ddPA at all.
> 
> Drop the mapping and report no driver data in the shared area as well.
> This also removes a probe failure path and the adapter_pa field.
> 
> Fixes: b0eb57cb97e7 ("VMXNET3: Add support for virtual IOMMU")
> Reported-by: syzbot+8eed6f83440ecdaf4be6@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=8eed6f83440ecdaf4be6
> Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
> ---
> Tested in QEMU (q35, KVM) on net/main (abeacca61eea), with KASAN,
> CONFIG_DMA_API_DEBUG and fail_page_alloc (min-order=4, as in the syzbot
> reproducer):
> 
> - syzbot C reproducer: before, "rejecting DMA map of vmalloc memory"
>   WARNING and probe fails with -EFAULT; after, no warning (probe then
>   fails at BAR mapping, as the reproducer binds vmxnet3 to a non-vmxnet3
>   device).
> - QEMU's emulated vmxnet3 (-device vmxnet3): probes, link up, ping
>   works, before and after.
> - Same NIC unbound and rebound with order>=4 page allocations failing:
>   before, the WARNING and probe fails, so the NIC is gone; after, it
>   binds and ping works.
> 
> No new W=1 warnings in drivers/net/vmxnet3/. Not tested on ESXi.
> 
>  drivers/net/vmxnet3/vmxnet3_drv.c | 19 +++----------------
>  drivers/net/vmxnet3/vmxnet3_int.h |  1 -
>  2 files changed, 3 insertions(+), 17 deletions(-)

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] vmxnet3: stop DMA mapping the adapter structure

[Jakub Kicinski]

On Thu, 22 Oct 2026 03:42:12 +0530 Arnav Kapoor wrote:
> vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
> dma_map_single() and passes its address to the device as the "driver
> data" (misc.ddPA/ddLen) in the shared area.
> 
> The adapter is the netdev private area, and alloc_netdev_mqs() allocates
> it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
> and is well above PAGE_SIZE, so when a high-order allocation fails the
> adapter ends up in vmalloc memory. dma_map_single() then warns
> ("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
> and probe fails with -EFAULT. syzbot hit this with page allocation
> fault injection.
> 
> The driver data is only informational: the mapping is DMA_TO_DEVICE,
> done once at probe and never synced, so the device could only ever see
> a stale copy. The per-queue descriptors in this driver already report
> no driver data with ddPA = ~0ULL and ddLen = 0, and other vmxnet3
> drivers, such as the one in DPDK, never set misc.ddPA at all.
> 
> Drop the mapping and report no driver data in the shared area as well.
> This also removes a probe failure path and the adapter_pa field.

Sounds fair but this does not seem like a real fix.
If nobody complained about this failure mode for 13 years
chances are we break more than we fix here.

Please repost this for net-next in a couple of weeks without
a Fixes tag.

Also please remove the "never synced" stuff. That's purely
relevant for intentionally hamstrung kernels. This is virt,
there's no DMA to sync other than swiotlb.
-- 
pw-bot: defer