From 8096f8d3547e97ca98628ff9b784bc9dc368d4f8 Mon Sep 17 00:00:00 2001 From: dujunbao <14829755+du-junbao@user.noreply.gitee.com> Date: Tue, 22 Sep 2026 21:15:47 +0800 Subject: [PATCH] ub: ubmempfd: unmap the partially mapped area from its real start ubmempfd_do_iommu_map() maps the request area by area, advancing uba_start past every IOVA range it has already handed to iommu_map(). When any of those mappings or the final tail mapping fails, the error path tears the partial mapping down so the IOVA stays usable. The teardown passes uba_start as the base address, but uba_start is the end of the mapped range, not its start: the mapping begins at req->uba. iommu_unmap() therefore never sees the ranges that were actually mapped nothing is torn down, the IOVA ranges stay mapped for the lifetime of the domain, and a later demap of the same request fails because the ranges do not add up any more. If the domain happens to have an unrelated mapping at uba_start, that range is removed instead. Pass req->uba as the base address, which is where the mapping started and what the accumulated length uba_start - req->uba is relative to. Fixes: bd7dc29d77ba ("ub: ubmempfd: supports for D2H mapping and demapping") --- drivers/ub/ubmempfd/ubmempfd_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ub/ubmempfd/ubmempfd_main.c b/drivers/ub/ubmempfd/ubmempfd_main.c index 3105aa42e554..817a20445cf1 100644 --- a/drivers/ub/ubmempfd/ubmempfd_main.c +++ b/drivers/ub/ubmempfd/ubmempfd_main.c @@ -147,7 +147,7 @@ static int ubmempfd_do_iommu_map(struct iommu_domain *domain, struct ubm_request if (uba_start - req->uba != req->size) { pr_err("iommu map size match failed expect size = %llu, mapped size = %llu, ret %d.\n", req->size, uba_start - req->uba, ret); - iommu_unmap(domain, uba_start, uba_start - req->uba); + iommu_unmap(domain, req->uba, uba_start - req->uba); } return ret; -- Gitee