spi: fix zero-length scatterlist entries for vmalloc buffers

spi_map_buf_attrs() sizes the sg table with

	DIV_ROUND_UP(len + offset_in_page(buf), desc_len)

but fills the entries with

	min(desc_len, min(len, PAGE_SIZE - offset_in_page(buf)))

Those two expressions only agree when a page boundary coincides with a
chunk boundary.  On 64K pages with a controller whose max_seg_size is
smaller than PAGE_SIZE, a buffer that is not page aligned produces a
table that is one or more entries too large, and the trailing entries are
filled with length 0.

dma_map_sgtable() maps every entry up to sgt->orig_nents, so such an
entry reaches dma_direct_map_sg() -> dma_direct_map_page(size = 0).
dma_capable() computes end = addr + size - 1, i.e. addr - 1 for a zero
sized mapping, which is false for any buffer above the device DMA mask,
and swiotlb_map() then calls swiotlb_tbl_map_single(size = 0) ->
swiotlb_do_find_slots(), where

	BUG_ON(!nslots);

fires because nr_slots(0) is 0.  On 4K pages desc_len always equals
PAGE_SIZE and the page boundary absorbs the offset, which is why this has
only been observed after switching to 64K pages.

Fix the entry count to match the way the loop consumes the buffer.

Signed-off-by: Chunfa Zhang <zcf1810@163.com>
Link: https://patch.msgid.link/179334613930.227576.16591083055909656623@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>

0 files changed, 0 insertions, 0 deletions