[PATCH] nvme-pci: unmap the full IOVA range on PRP setup failure

[PATCH] nvme-pci: unmap the full IOVA range on PRP setup failure

[guzebing]

From: Guzebing <guzebing@bytedance.com>

When using IOVA, blk_rq_dma_map_iter_start() maps the entire request
before PRP construction begins. However, iod->total_len is accumulated
as PRPs are populated. If a PRP list allocation fails, nvme_unmap_data()
passes this partial length to blk_rq_dma_unmap(), leaving part of the
request's DMA mapping intact.

Use dma_iova_size() as the unmap length for IOVA mappings so that
cleanup covers the full range mapped by blk_rq_dma_map_iter_start(),
even when PRP construction fails.

Fixes: 7ce3c1dd78fc ("nvme-pci: convert the data mapping to blk_rq_dma_map")
Signed-off-by: Guzebing <guzebing@bytedance.com>
---
 drivers/nvme/host/pci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 77317e5d00f9f..4f07425afb8d5 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -958,8 +958,9 @@ static void nvme_unmap_data(struct request *req)
 		attrs |= DMA_ATTR_MMIO;
 	}
 
-	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len,
-			      map)) {
+	/* IOVA mappings cover the full request even if PRP setup fails. */
+	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state,
+			      dma_iova_size(&iod->dma_state), map)) {
 		if (nvme_pci_cmd_use_sgl(&iod->cmd))
 			nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,
 			               iod->descriptors[0], attrs);
-- 
2.20.1

Re: [PATCH] nvme-pci: unmap the full IOVA range on PRP setup failure

[Keith Busch]

On Tue, Oct 27, 2026 at 07:57:18PM +0800, guzebing wrote:
> When using IOVA, blk_rq_dma_map_iter_start() maps the entire request
> before PRP construction begins. However, iod->total_len is accumulated
> as PRPs are populated. If a PRP list allocation fails, nvme_unmap_data()
> passes this partial length to blk_rq_dma_unmap(), leaving part of the
> request's DMA mapping intact.
>
> Use dma_iova_size() as the unmap length for IOVA mappings so that
> cleanup covers the full range mapped by blk_rq_dma_map_iter_start(),
> even when PRP construction fails.

I don't think this is right. The dma state's iova size was set when it
was allocated, but there are failure scenarios where we've only linked
part of the request. I think the iod's total_len is just not in sync
with the pinned mappings. We should update the total_len as we iterate
the blk_mq_dma_iter, not when we've assigned a PRP element.