[PATCH] nvme-pci: unmap the full IOVA range on PRP setup failure

[guzebing <guzebing1612@gmail.com>]

From: Guzebing <guzebing@bytedance.com>

When using IOVA, blk_rq_dma_map_iter_start() maps the entire request
before PRP construction begins. However, iod->total_len is accumulated
as PRPs are populated. If a PRP list allocation fails, nvme_unmap_data()
passes this partial length to blk_rq_dma_unmap(), leaving part of the
request's DMA mapping intact.

Use dma_iova_size() as the unmap length for IOVA mappings so that
cleanup covers the full range mapped by blk_rq_dma_map_iter_start(),
even when PRP construction fails.

Fixes: 7ce3c1dd78fc ("nvme-pci: convert the data mapping to blk_rq_dma_map")
Signed-off-by: Guzebing <guzebing@bytedance.com>
---
 drivers/nvme/host/pci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 77317e5d00f9f..4f07425afb8d5 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -958,8 +958,9 @@ static void nvme_unmap_data(struct request *req)
 		attrs |= DMA_ATTR_MMIO;
 	}
 
-	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len,
-			      map)) {
+	/* IOVA mappings cover the full request even if PRP setup fails. */
+	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state,
+			      dma_iova_size(&iod->dma_state), map)) {
 		if (nvme_pci_cmd_use_sgl(&iod->cmd))
 			nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,
 			               iod->descriptors[0], attrs);
-- 
2.20.1