Re: [PATCH] iommu/dma: Rate-limit WARN in iommu_dma_unmap_phys()

[Leon Romanovsky]

On Wed, Feb 11, 2026 at 07:13:03AM -0800, Breno Leitao wrote:
> When a PCI error (e.g. AER error or DPC containment) marks the PCI
> channel as frozen or permanently failed, the IOMMU mappings for the
> device may already be torn down. If a driver continues processing
> completions in this state, every call to dma_unmap_page() triggers a
> WARN_ON in iommu_dma_unmap_phys().
> 
> In a real-world crash scenario on an NVIDIA Grace (ARM64) platform, a
> DPC event froze the PCI channel and the mlx5 NAPI poll continued
> processing error CQEs, calling dma_unmap for each pending WQE. With
> dozens of pending WQEs, the resulting WARN_ON storm monopolized the CPU
> in softirq context for over 23 seconds, triggering a soft lockup panic.
> 
> Replace WARN_ON(!phys) with WARN_RATELIMIT() to cap the warning output
> at the kernel's default rate limit (10 messages per 5 seconds), while
> still providing visibility into the failure with the device name in the
> message.
> 
> Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
> Fixes: 82612d66d51d ("iommu: Allow the dma-iommu api to use bounce buffers")
> ---
> I initially attempted to fix this in the driver itself, but that approach
> doesn't appear to be optimal, given the mappings can go away at any
> time, which is impossible to check at any time. Please see the discussion at:
> 
> https://lore.kernel.org/all/20260209-mlx5_iommu-v1-1-b17ae501aeb2@xxxxxxxxxx/
> ---
>  drivers/iommu/dma-iommu.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

We have similar failure in our regression and the proposal fix is below,
can you please try if it fixes your issue too?

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
index 9e2cf191ed30..ac64a64e0565 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
@@ -44,7 +44,6 @@ static void mlx5e_reset_txqsq_cc_pc(struct mlx5e_txqsq *sq)
                  "SQ 0x%x: cc (0x%x) != pc (0x%x)\n",
                  sq->sqn, sq->cc, sq->pc);
        sq->cc = 0;
-       sq->dma_fifo_cc = 0;
        sq->pc = 0;
 }