Re: [PATCH net] vmxnet3: stop DMA mapping the adapter structure

[Simon Horman]

On Thu, Oct 22, 2026 at 03:42:12AM +0530, Arnav Kapoor wrote:
> vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
> dma_map_single() and passes its address to the device as the "driver
> data" (misc.ddPA/ddLen) in the shared area.
> 
> The adapter is the netdev private area, and alloc_netdev_mqs() allocates
> it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
> and is well above PAGE_SIZE, so when a high-order allocation fails the
> adapter ends up in vmalloc memory. dma_map_single() then warns
> ("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
> and probe fails with -EFAULT. syzbot hit this with page allocation
> fault injection.
> 
> The driver data is only informational: the mapping is DMA_TO_DEVICE,
> done once at probe and never synced, so the device could only ever see
> a stale copy. The per-queue descriptors in this driver already report
> no driver data with ddPA = ~0ULL and ddLen = 0, and other vmxnet3
> drivers, such as the one in DPDK, never set misc.ddPA at all.
> 
> Drop the mapping and report no driver data in the shared area as well.
> This also removes a probe failure path and the adapter_pa field.
> 
> Fixes: b0eb57cb97e7 ("VMXNET3: Add support for virtual IOMMU")
> Reported-by: syzbot+8eed6f83440ecdaf4be6@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=8eed6f83440ecdaf4be6
> Signed-off-by: Arnav Kapoor <kapoorarnav43@xxxxxxxxx>
> ---
> Tested in QEMU (q35, KVM) on net/main (abeacca61eea), with KASAN,
> CONFIG_DMA_API_DEBUG and fail_page_alloc (min-order=4, as in the syzbot
> reproducer):
> 
> - syzbot C reproducer: before, "rejecting DMA map of vmalloc memory"
>   WARNING and probe fails with -EFAULT; after, no warning (probe then
>   fails at BAR mapping, as the reproducer binds vmxnet3 to a non-vmxnet3
>   device).
> - QEMU's emulated vmxnet3 (-device vmxnet3): probes, link up, ping
>   works, before and after.
> - Same NIC unbound and rebound with order>=4 page allocations failing:
>   before, the WARNING and probe fails, so the NIC is gone; after, it
>   binds and ping works.
> 
> No new W=1 warnings in drivers/net/vmxnet3/. Not tested on ESXi.
> 
>  drivers/net/vmxnet3/vmxnet3_drv.c | 19 +++----------------
>  drivers/net/vmxnet3/vmxnet3_int.h |  1 -
>  2 files changed, 3 insertions(+), 17 deletions(-)

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>