From nobody Sat Sep 26 21:13:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E17E42A80; Sun, 30 Aug 2026 11:16:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088604; cv=none; b=l7Z/zhBZs1sZpAqI6rW0nK88CtQSBhLFNf0As6DT0iujSjElSvSifMzEFT2YKh0V3grGvyrFebdpgyYfOepYIUHty2eemT1K9WctntJPydhdljnSvA2UTtuZEjkb6hWLCXs/ULShmx9lIxU+/ekeLB3e2Bqr9bJIlhqyNdHvLe0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088604; c=relaxed/simple; bh=MxPchrCGEnW8Fn2Tx11QUCAyap0JeYiS+ef/9Em0MDs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lZZ4FQfp7ArDkhyiPZfQ6tgoeQ1sUyc/3rg3U1BNK6L5tXM2xQdIlcc48PypO+6dUsqyMhRthcMXCkg3VK1WZZjTEYzMw39xt1F7X2OiLPzImkJhhsFxkvFjmn855VZoISeboEiuluwXgURIJa9OIevEf/epvvdbFJnJnT5NhMw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HTovb9nP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HTovb9nP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51A771F000E9; Sun, 30 Aug 2026 11:16:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788088603; bh=Bl5Y80X30qdvcME+5ilD24BMrm2KAas3+maUv1puLFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HTovb9nPdUhkyuJB3P2YrINrK/gcsVxxjZUwISCKLwgbU0asgyHwLeLJ9P4nFdkRv cD7jwjjhKkqeo378pMbJTA95CU0ZSP6YVgd3kTJTaroov6XG+CG5cRXyGw/k5hvL9B tgQeQdsbAjCKRztlf2PFsNDKwrgjIBTM93DaiCMiZdKG/2kgaIGMq1mkB5TS/TmfPK IYS6K4U5za9+UMc2c6koCiN7GLIvXR/M2AX0O2gQw6hmp8Myqr36nf72Ks8pSM05Yo OOrHSS+w6HJxZJXIC4Kdmfr01dc/PEcg4kTOR+V30KQGUcz7OwuLqywuvFFxH+0GFE lRLsjp4l/8B+Q== From: Leon Romanovsky To: Bjorn Helgaas , Logan Gunthorpe , Greg Kroah-Hartman , Jens Axboe , Chaitanya Kulkarni , Leon Romanovsky , Jason Gunthorpe , Ankit Agrawal , Alex Williamson Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Tushar Dave , Jason Gunthorpe Subject: [PATCH 1/5] PCI/P2PDMA: Do not tear down the allocate attribute on registration failure Date: Sun, 30 Aug 2026 14:16:19 +0300 Message-ID: <20260830-batch-p2p-fixes-v1-1-5044e8dfbe2e@nvidia.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> References: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.15-dev-18f8f Content-Transfer-Encoding: quoted-printable From: Leon Romanovsky pci_p2pdma_add_resource() installs pci_p2pdma_unmap_mappings() as a devres action with the devres allocated p2p_pgmap as its data, and only then adds the range to the pool: error =3D devm_add_action_or_reset(&pdev->dev, pci_p2pdma_unmap_mappings, p2p_pgmap); if (error) goto pages_free; p2pdma =3D rcu_dereference_protected(pdev->p2pdma, 1); error =3D gen_pool_add_owner(p2pdma->pool, ...); if (error) goto pages_free; The action removes the allocate attribute for the whole device, which tears down existing userspace mappings of every BAR already registered on it. Both failures here get that wrong, in opposite ways. devm_add_action_or_reset() runs the action when it cannot allocate its devres node, so an -ENOMEM while registering a second BAR unmaps the first one. Use devm_add_action() and let the error path unwind only what this call created. gen_pool_add_owner() allocates a chunk and can also fail with -ENOMEM. There the action is registered, and the error path frees p2p_pgmap with devm_kfree() while leaving the action pointing at it. On unbind devres runs the action and pci_p2pdma_unmap_mappings() dereferences p2p_pgmap->mem->owner->kobj, which is freed memory. Give that failure its own label and drop the action with devm_remove_action(), which removes it without running it. Fixes: 7e9c7ef83d78 ("PCI/P2PDMA: Allow userspace VMA allocations through s= ysfs") Fixes: f58ef9d1d135 ("PCI/P2PDMA: Separate the mmap() support from the core= logic") Reviewed-by: Logan Gunthorpe Reviewed-by: Jason Gunthorpe Tested-by: Tushar Dave Signed-off-by: Leon Romanovsky --- drivers/pci/p2pdma.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index 9334eb314663..8124bcebfa2d 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -440,8 +440,8 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int b= ar, size_t size, goto pgmap_free; } =20 - error =3D devm_add_action_or_reset(&pdev->dev, pci_p2pdma_unmap_mappings, - p2p_pgmap); + error =3D devm_add_action(&pdev->dev, pci_p2pdma_unmap_mappings, + p2p_pgmap); if (error) goto pages_free; =20 @@ -451,13 +451,15 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int= bar, size_t size, range_len(&pgmap->range), dev_to_node(&pdev->dev), &pgmap->ref); if (error) - goto pages_free; + goto mappings_remove; =20 pci_info(pdev, "added peer-to-peer DMA memory %#llx-%#llx\n", pgmap->range.start, pgmap->range.end); =20 return 0; =20 +mappings_remove: + devm_remove_action(&pdev->dev, pci_p2pdma_unmap_mappings, p2p_pgmap); pages_free: devm_memunmap_pages(&pdev->dev, pgmap); pgmap_free: --=20 2.55.0 From nobody Sat Sep 26 21:13:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B438377541; Sun, 30 Aug 2026 11:16:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088620; cv=none; b=uXBy/FH/p4AFc7MCp1IizRXje28Y+skjChzNjLOlruppHgOqoR5Qwt6O0a0hWe70bXW4UxtgxnsQ0CdoTL4ibGLZK5mf+X9e2DVdofzKOzAsmUy8EIaVpqI9Zneq7FEGvmOsdkyJv4v++etvGVz4rdBeT/pbDdC7jFwTW2y1aNE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088620; c=relaxed/simple; bh=arvcGPLAtx9kdz/Nna6AalE1jUjN1cZQYseIppAGV80=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=EmvImaK6qJ1Ee5aqbVuz8Tea4o4ptn/lWBN69GhcaDXF5/3O+saqfzDuz6e3VHbfZJkTRuorwjHpbHIgKCFQyZ10PYLzO+3TvClUB2C0qmqF1ufY7yAl0xf78luVestMFAZ3iK7Ov0mIHaYFePidydi4ePcRPldUBoySiMOQ5Fc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UVBBNCa9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UVBBNCa9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 325921F000E9; Sun, 30 Aug 2026 11:16:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788088619; bh=psWVQVgbUDHweiM3yjAu3JCbbJPHY6xgWv490+/SFmY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UVBBNCa9vB/aK5LqqMdVr+rO7F7Tq7AaEDMcmDThcabbm2HgX97/R0gggyC4Is38I df4HP/E4Ypv2G2Z8zu+WrCihnReVH5jQPInSQ7EbDcEZzW4/3+KLXRmxttoh7z4deE Cwx2VfEGsjJte9ttM84bI6bUqUIDdPctQFEAcoYdwP7GLhDdwe17tZSHQNMKe2L2IE HZK8qulxmpj96898oa5AEM9V/owoRceUkAa0Cjk2Dft3hILDhL9VykEgZfgu7xI/lR mzOtRzcYwtPLvKbQAZzcAqJGk6zUoU/ggfNJMV4Chyhzhl90NSaE/tJ2K/iRT/K9l8 QLRF2GnnWu7YA== From: Leon Romanovsky To: Bjorn Helgaas , Logan Gunthorpe , Greg Kroah-Hartman , Jens Axboe , Chaitanya Kulkarni , Leon Romanovsky , Jason Gunthorpe , Ankit Agrawal , Alex Williamson Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Matt Evans , Tushar Dave , Jason Gunthorpe Subject: [PATCH 2/5] PCI/P2PDMA: Wait for RCU readers before freeing state Date: Sun, 30 Aug 2026 14:16:20 +0300 Message-ID: <20260830-batch-p2p-fixes-v1-2-5044e8dfbe2e@nvidia.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> References: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.15-dev-18f8f Content-Transfer-Encoding: quoted-printable From: Leon Romanovsky pci_p2pmem_find_many() scans all PCI devices without locking or protection against driver unbind, including devices with poolless P2PDMA state. pci_has_p2pmem() may observe pdev->p2pdma just before driver unbind clears it, while pci_p2pdma_release() skips the grace period when no pool is present. This allows devres to free the object while it is still in use. Clear the pointer with RCU_INIT_POINTER() and always wait for pre-existing RCU readers before returning. The same grace period continues to protect gen_pool users for pool-backed providers. Cc: Alex Williamson Cc: Matt Evans Fixes: 372d6d1b8ae3 ("PCI/P2PDMA: Refactor to separate core P2P functionali= ty from memory allocation") Reviewed-by: Logan Gunthorpe Reviewed-by: Jason Gunthorpe Tested-by: Tushar Dave Signed-off-by: Leon Romanovsky --- drivers/pci/p2pdma.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index 8124bcebfa2d..52974809e1e1 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -236,9 +236,8 @@ static void pci_p2pdma_release(void *data) return; =20 /* Flush and disable pci_alloc_p2p_mem() */ - pdev->p2pdma =3D NULL; - if (p2pdma->pool) - synchronize_rcu(); + RCU_INIT_POINTER(pdev->p2pdma, NULL); + synchronize_rcu(); xa_destroy(&p2pdma->map_types); =20 if (!p2pdma->pool) --=20 2.55.0 From nobody Sat Sep 26 21:13:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 819A82FC037; Sun, 30 Aug 2026 11:16:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088608; cv=none; b=A2rAzT/MLvAQK6FiEBUe5kWNyjOTLudhdSgY8ab6uNVIr5LcIogQKAeCDZOhn0UlJRSsWlIXZlxud84WJNkO3XUugtam0rS3N/6dgj9qojqDZJi5YkQJynxwx56jb0tzjaxhZJXYEwDIF6o3eIZI/usd4n++YYXt53vWWiYGv/M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088608; c=relaxed/simple; bh=BKpVxp53wFvGlRYRjDhQtPN3mxR0VIrMUa9NIuhosfs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=jXZ5LcM8jXcZWJQB4150CS83HWJ3tUXXSPb3sApNdB299XPgb5AXJ78dho0NbOGrsCoX8+EA3gPnaluGuB015JHq2GKo0zD1Oz7SoQ3LuHhNW9xt9g2BVzhQp5lCetowt5pVuEIFuhdeOqGr/+YMSN6s89qBJ+LkLV1ikNtFXlU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Uglw11Rp; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Uglw11Rp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E6241F00A3D; Sun, 30 Aug 2026 11:16:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788088607; bh=sPzYy38ih5YMqJ5osvNb82dFMuSh9qJRODkldCZTot8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Uglw11RpgG+CSUd1sOEOYcc+mZdTBZX46mXKW0z/LMfbzB0+4yIagvH5Byu8hzeoU vq/LF1PPMqNgZBcfW7sLaCMozjZlqg8mhzEE38hDtUwzu6KURUtKLDw6Ec07Yj4zZH g7mL4/h5vwm7m9qTQbjwfe60SNnVhRWvTw/sBcDyZzC2m6RaTAtBRPrvq8E7V37SnV ks/txDaJlzcIo5Mkv7nMuXcqJiqQsGKkGUQiTeRvsXhlLMK5qdznK6sUpngC1Jw4h+ 7vPldfxKBpnRrSexmf8RRbIcLqSbIZ57PZq/gJrgo626TkzPm7gKJz+yZvNTdmM5Ej SwqNsJqBIXfZA== From: Leon Romanovsky To: Bjorn Helgaas , Logan Gunthorpe , Greg Kroah-Hartman , Jens Axboe , Chaitanya Kulkarni , Leon Romanovsky , Jason Gunthorpe , Ankit Agrawal , Alex Williamson Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Tushar Dave , Jason Gunthorpe Subject: [PATCH 3/5] PCI/P2PDMA: Restrict the p2pmem search to pool backed providers Date: Sun, 30 Aug 2026 14:16:21 +0300 Message-ID: <20260830-batch-p2p-fixes-v1-3-5044e8dfbe2e@nvidia.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> References: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.15-dev-18f8f Content-Transfer-Encoding: quoted-printable From: Leon Romanovsky pci_p2pmem_find_many() exists to pick a provider that the caller will then allocate from with pci_alloc_p2pmem(), which goes straight to the gen_pool: ret =3D (void *)gen_pool_alloc_owner(p2pdma->pool, size, (void **) &ref); pci_has_p2pmem() does not ask for that pool, only for the published flag. The two used to be equivalent, because a provider could only exist by way of pci_p2pdma_add_resource(), which always creates the pool. pcim_p2pdma_init() broke that. It registers a provider for the DMABUF path and never creates a pool, so pdev->p2pdma is set while p2pdma->pool stays NULL. Nothing publishes such a provider today, so the search cannot return one yet, but the flag alone no longer says what the caller needs. Ask for the pool as well, so the search covers the providers its result is used for. A later patch documents the pdev->p2pdma lifetime and RCU rules. Reviewed-by: Logan Gunthorpe Reviewed-by: Jason Gunthorpe Tested-by: Tushar Dave Signed-off-by: Leon Romanovsky --- drivers/pci/p2pdma.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index 52974809e1e1..914848a993ba 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -868,7 +868,12 @@ static bool pci_has_p2pmem(struct pci_dev *pdev) =20 rcu_read_lock(); p2pdma =3D rcu_dereference(pdev->p2pdma); - res =3D p2pdma && p2pdma->p2pmem_published; + /* + * The callers hand the result to pci_alloc_p2pmem(), so only a + * provider backed by a pool is of any use here. pcim_p2pdma_init() + * creates providers without one. + */ + res =3D p2pdma && p2pdma->pool && p2pdma->p2pmem_published; rcu_read_unlock(); =20 return res; --=20 2.55.0 From nobody Sat Sep 26 21:13:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 39BED2C08BB; Sun, 30 Aug 2026 11:16:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088613; cv=none; b=Q20k5YvCDIchJiGHoFqtCLqNa8HbC7dbMyOGmvGOei51F7mFcdwvpHEg598We18Pzk0DO6431WTHbszEvTb11gMMCgnv5lYGOIOyypcWbSN68EnpSfBy6UTHJgSTgeVqbcivsWw/qrmPhEf1NRNtrsMB26zXjuJrvn/eZYDGQfs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088613; c=relaxed/simple; bh=5N7JkjQRgXMOd9K27Ip3vidVUtsrPx/4to79EI7m8lo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=smZIS9CYcW4Cf4+X9PJghN0X4vN+jdf+5akzbbkaq+XURfbu2d2SnHBLIA1NYAJHQSCUM23ks5R7Lp5SQttl7a/+LekpXUshgiqZALFhrpQTxdPkLsJld+1YY2vy8FxCTIUCeQGgD39mKP4ussN4lssHUgXFWIBQVeOq0h7kbLM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fU8LPYwU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fU8LPYwU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09A1C1F000E9; Sun, 30 Aug 2026 11:16:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788088611; bh=vEfiAdgfV9OK268PtYpN2GbfHnKznFcN2c5SD+05258=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fU8LPYwUYnp7VkN63nSlcPS42IRhxLi9p2lF4B7HSyISrBTidREwRWVihQA4pxE49 li7PZ/HCSbGkoh+XsAvjYA9eotHT+JAEQYhrmq3W+l0dL1BGAnVzmG16I5cqh4mlia /IN0gqI7HMulyBQrQC1ehXItFMiWNndIAqBRrBQTD2ZrguVzJ/7GkFSuSoh/cCWXLp GhuEpLd+QH6aZCTge9u2h73PBdbWKa61i92I/RbU0CuAlzjQKuyx1fRwcV2zRi9A8J vq8RRU02eA1S9wDs0MJ07TobU6tfjPcQh+gIfce8bx78YAu8W8RyZDq6RWcTjh13u5 0q7wd55t/1U4Q== From: Leon Romanovsky To: Bjorn Helgaas , Logan Gunthorpe , Greg Kroah-Hartman , Jens Axboe , Chaitanya Kulkarni , Leon Romanovsky , Jason Gunthorpe , Ankit Agrawal , Alex Williamson Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Tushar Dave , Jason Gunthorpe Subject: [PATCH 4/5] PCI/P2PDMA: Safely terminate ACS redirect lists Date: Sun, 30 Aug 2026 14:16:22 +0300 Message-ID: <20260830-batch-p2p-fixes-v1-4-5044e8dfbe2e@nvidia.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> References: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.15-dev-18f8f Content-Transfer-Encoding: quoted-printable From: Leon Romanovsky seq_buf marks an overflow by setting len to size + 1. The ACS diagnostic path unconditionally writes a terminator to buffer[len - 1], so a path with enough ACS ports to fill the 128-byte buffer writes one byte beyond the buffer when verbose diagnostics are requested. Use seq_buf_str() to terminate truncated output safely and remove the final semicolon only when the buffer did not overflow. Fixes: 52916982af48 ("PCI/P2PDMA: Support peer-to-peer memory") Reviewed-by: Logan Gunthorpe Reviewed-by: Jason Gunthorpe Tested-by: Tushar Dave Signed-off-by: Leon Romanovsky --- drivers/pci/p2pdma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index 914848a993ba..becc869cbc17 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -772,11 +772,13 @@ calc_map_type_and_dist(struct pci_dev *provider, stru= ct pci_dev *client, } =20 if (verbose) { - acs_list.buffer[acs_list.len-1] =3D 0; /* drop final semicolon */ + /* Drop the final semicolon; the list is not empty here. */ + if (!seq_buf_has_overflowed(&acs_list)) + acs_list.buffer[acs_list.len - 1] =3D '\0'; pci_warn(client, "ACS redirect is set between the client and provider (%= s)\n", pci_name(provider)); pci_warn(client, "to disable ACS redirect for this path, add the kernel = parameter: pci=3Ddisable_acs_redir=3D%s\n", - acs_list.buffer); + seq_buf_str(&acs_list)); } acs_redirects =3D true; =20 --=20 2.55.0 From nobody Sat Sep 26 21:13:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDCE33911B2; Sun, 30 Aug 2026 11:16:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088617; cv=none; b=emINDZq10BAUVhQjaL6RLpzcppWShfgQ0nLB5w9FPefe47iA+0kvw3rARd4dxZHXERIiluQ7537sH9N/jaE8ccSkpEiBrToCJxwHynp8FJtIdfa1lPQqFFp/wKgRU+VavfyfZwpAKgIumy8xrvXS8BFehTakBuP0Vh93iNVnlIQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788088617; c=relaxed/simple; bh=BgPyX35b9suPNW2T4JOwnyvPa21cbCukwwK56ZZK7SA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=IgOy0Y4loLM4zILl40OSXssmzyy9bQv2MN8kKcgUX2FDrGY7rkRD6gqLco6PJJ8YXQUhqEeECD4wHKAZ1fyO1X28XT7Mtkxp110vhcUXzYdLIIERJl5JHC6PRuQZDtgVWNSOeNfFN9mU5K6eA6WHLLUoy3V/668mSznmecLW7tA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fU2FB3Ms; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fU2FB3Ms" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B11A11F000E9; Sun, 30 Aug 2026 11:16:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788088615; bh=Lc5Iaug9KuYhX8qYuPq3mQvPE1l5alFIeiwqy+WRyOs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fU2FB3MscpdV26VVD0Aony0aB6ijppmBXgYaAmN3LLKIuPff28UgmMyhfCJ0o7M9D hy+u8mGBqhau7p5YdMjI2j9inB598HVbvAGRR2PMeTMDNhO8Icc0cPRPbOf7m0hfd4 5XHAgD584gHRD1egBcPXEOutXngd5TPwa6lplTgLwHOV7HqOxVdH1nXe6g8+NgKz+t 1HNv5v6GCXfAmJIa1tRDVUY5jnNiqBdXhgwUrxExGAuSoZ5c4yAPTplYUfejP/gmrG ks3D9Nw73PxaOHz0/9UMpnIKGKFpz6Y193RJx92Vt74gGKVZZsSN8ShlUfQmJhov2m EGfk70WqpVPwg== From: Leon Romanovsky To: Bjorn Helgaas , Logan Gunthorpe , Greg Kroah-Hartman , Jens Axboe , Chaitanya Kulkarni , Leon Romanovsky , Jason Gunthorpe , Ankit Agrawal , Alex Williamson Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Tushar Dave , Jason Gunthorpe Subject: [PATCH 5/5] PCI/P2PDMA: Gate the host bridge whitelist warning on verbose Date: Sun, 30 Aug 2026 14:16:23 +0300 Message-ID: <20260830-batch-p2p-fixes-v1-5-5044e8dfbe2e@nvidia.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> References: <20260830-batch-p2p-fixes-v1-0-5044e8dfbe2e@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.15-dev-18f8f Content-Transfer-Encoding: quoted-printable From: Leon Romanovsky calc_map_type_and_dist() prints every other diagnostic under its verbose argument, but reaches the "Host bridge not in P2PDMA whitelist" warning through host_bridge_whitelist(), which it hands acs_redirects instead. A caller that asked for a silent answer still gets the warning whenever any port on the path has an ACS redirect bit set, the CPU is not whitelisted by cpu_supports_p2pdma(), and the host bridge is not in pci_p2pdma_whitelist[]. pci_p2pmem_find_many() is such a caller. It sweeps every device with published p2pmem and asks for the distance to each client with verbose=3Dfalse, and pci_p2pdma_distance_many() recomputes rather than consulting the map_types cache, so the warning repeats on every sweep. The argument was never meant to say "ACS redirects were found". When commit cf201bfe8cdc ("PCI/P2PDMA: Warn if host bridge not in whitelist") added it, acs_redirects was a bool pointer that the quiet entry point passed as NULL: if (verbose) map =3D calc_map_type_and_dist_warn(provider, pci_client, &distance); else map =3D calc_map_type_and_dist(provider, pci_client, &distance, NULL, NULL); so the argument was true on exactly the path that commit describes. Folding the two entry points into one verbose flag turned the pointer into a value and left the call site alone, silently narrowing the warning to paths that carry an ACS redirect. Pass verbose. This also restores the warning for a verbose caller that takes the host bridge route with no ACS redirect on the path, which until now was told it could not use peer-to-peer DMA without being told which vendor and device would have to be added to the whitelist. Fixes: d1b8dc09dd71 ("PCI/P2PDMA: Simplify distance calculation") Reviewed-by: Jason Gunthorpe Reviewed-by: Logan Gunthorpe Tested-by: Tushar Dave Signed-off-by: Leon Romanovsky --- drivers/pci/p2pdma.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index becc869cbc17..349537b4fa42 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -709,7 +709,6 @@ calc_map_type_and_dist(struct pci_dev *provider, struct= pci_dev *client, { enum pci_p2pdma_map_type map_type =3D PCI_P2PDMA_MAP_THRU_HOST_BRIDGE; struct pci_dev *a =3D provider, *b =3D client, *bb; - bool acs_redirects =3D false; struct pci_p2pdma *p2pdma; struct seq_buf acs_list; int acs_cnt =3D 0; @@ -780,11 +779,10 @@ calc_map_type_and_dist(struct pci_dev *provider, stru= ct pci_dev *client, pci_warn(client, "to disable ACS redirect for this path, add the kernel = parameter: pci=3Ddisable_acs_redir=3D%s\n", seq_buf_str(&acs_list)); } - acs_redirects =3D true; =20 map_through_host_bridge: if (!cpu_supports_p2pdma() && - !host_bridge_whitelist(provider, client, acs_redirects)) { + !host_bridge_whitelist(provider, client, verbose)) { if (verbose) pci_warn(client, "cannot be used for peer-to-peer DMA as the client and= provider (%s) do not share an upstream bridge or whitelisted host bridge\n= ", pci_name(provider)); --=20 2.55.0