Re: [PATCH net-next 3/3] net: devmem: decode DMA addresses for TX

From: Pavel Begunkov

Date: Sun Sep 27 2026 - 14:21:12 EST


On 9/22/26 21:43, Stanislav Fomichev wrote:
On 32-bit architectures where dma_addr_t is wider than unsigned long,
page_pool_set_dma_addr_netmem() stores page-aligned DMA addresses shifted
by PAGE_SHIFT. The net_iov branch of __skb_frag_dma_map() adds byte offsets
to the encoded value, so the NIC is programmed with an invalid DMA address.
This can trigger an IOMMU fault or DMA from unintended memory.

Consolidate DMA address encoding, decoding, and representability checks in
netmem helpers. Use the common decoder from the page pool and net_iov TX
paths so both interpret stored addresses consistently.

Fixes: bd61848900bf ("net: devmem: Implement TX path")
Signed-off-by: Stanislav Fomichev <sdf@xxxxxxxxxxx>
---
include/linux/skbuff.h | 7 +++++--
include/net/netmem.h | 27 +++++++++++++++++++++++++++
include/net/page_pool/helpers.h | 10 +---------
net/core/page_pool_priv.h | 14 ++------------
4 files changed, 35 insertions(+), 23 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 421f6fc45451..3740d4b15b70 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3833,9 +3833,12 @@ static inline dma_addr_t __skb_frag_dma_map(struct device *dev,
size_t offset, size_t size,
enum dma_data_direction dir)
{
+ dma_addr_t addr;
+
if (skb_frag_is_net_iov(frag)) {
- return netmem_to_net_iov(frag->netmem)->desc.dma_addr +
- offset + frag->offset;
+ addr = netmem_dma_addr_decode(
+ netmem_get_dma_addr(frag->netmem));
+ return addr + offset + frag->offset;
Looks like just page_pool_get_dma_addr_netmem(). Just a note, but it'd
be nice to rename netmem_get_dma_addr() into something less confusing
as well.

--
Pavel Begunkov