Re: [PATCH net] vmxnet3: stop DMA mapping the adapter structure

[Jakub Kicinski]

On Thu, 22 Oct 2026 03:42:12 +0530 Arnav Kapoor wrote:
> vmxnet3_probe_device() maps the whole struct vmxnet3_adapter with
> dma_map_single() and passes its address to the device as the "driver
> data" (misc.ddPA/ddLen) in the shared area.
> 
> The adapter is the netdev private area, and alloc_netdev_mqs() allocates
> it with kvzalloc(). struct vmxnet3_adapter embeds 32 tx and 32 rx queues
> and is well above PAGE_SIZE, so when a high-order allocation fails the
> adapter ends up in vmalloc memory. dma_map_single() then warns
> ("rejecting DMA map of vmalloc memory") and returns DMA_MAPPING_ERROR,
> and probe fails with -EFAULT. syzbot hit this with page allocation
> fault injection.
> 
> The driver data is only informational: the mapping is DMA_TO_DEVICE,
> done once at probe and never synced, so the device could only ever see
> a stale copy. The per-queue descriptors in this driver already report
> no driver data with ddPA = ~0ULL and ddLen = 0, and other vmxnet3
> drivers, such as the one in DPDK, never set misc.ddPA at all.
> 
> Drop the mapping and report no driver data in the shared area as well.
> This also removes a probe failure path and the adapter_pa field.

Sounds fair but this does not seem like a real fix.
If nobody complained about this failure mode for 13 years
chances are we break more than we fix here.

Please repost this for net-next in a couple of weeks without
a Fixes tag.

Also please remove the "never synced" stuff. That's purely
relevant for intentionally hamstrung kernels. This is virt,
there's no DMA to sync other than swiotlb.
-- 
pw-bot: defer