On Tue, Mar 03, 2026 at 11:46:24AM +0800, Alex Mastro wrote:
> Remove the __iommu_unmap() call on a region that was never mapped.
> When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO
> modes), the region is not added to the dma_regions list, leaving its
> list_head zero-initialized. If the unmap ioctl returns success,
> __iommu_unmap() calls list_del_init() on this zeroed node and crashes.
>
> This fixes the iommufd_compat_type1 and iommufd_compat_type1v2
> test variants.
>
> Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test")
> Signed-off-by: Alex Mastro <[email protected]>
> ---
> The bug was missed because the test was originally run against a kernel
> without commit afb47765f923 ("iommufd: Make vfio_compat's unmap succeed
> if the range is already empty"). Without that fix, the unmap ioctl
> returned -ENOENT, taking the early return before list_del_init().
> ---
> tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> index 957a89ce7b3a..d7f25ef77671 100644
> --- a/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> +++ b/tools/testing/selftests/vfio/vfio_dma_mapping_mmio_test.c
> @@ -100,7 +100,6 @@ static void do_mmio_map_test(struct iommu *iommu,
> iommu_unmap(iommu, ®ion);
> } else {
Hi Alex,
> VFIO_ASSERT_NE(__iommu_map(iommu, ®ion), 0);
> - VFIO_ASSERT_NE(__iommu_unmap(iommu, ®ion, NULL), 0);
This is the more simply way to work w/ or w/o commit
afb47765f923 ("iommufd: Make vfio_compat's unmap succeed if
the range is already empty"), may worth to add this point
into the commit message.
For the changes:
Reviewed-by: Yuan Yao <[email protected]>
> }
> }
>
>
> ---
> base-commit: 96ca4caf9066f5ebd35b561a521af588a8eb0215
> change-id: 20260303-fix-mmio-test-d3bd688105f3
>
> Best regards,
> --
> Alex Mastro <[email protected]>
>
