[PATCH] nvme-pci: unmap the full IOVA range on PRP setup failure

[Keith Busch]

On Tue, Oct 27, 2026 at 07:57:18PM +0800, guzebing wrote:
> When using IOVA, blk_rq_dma_map_iter_start() maps the entire request
> before PRP construction begins. However, iod->total_len is accumulated
> as PRPs are populated. If a PRP list allocation fails, nvme_unmap_data()
> passes this partial length to blk_rq_dma_unmap(), leaving part of the
> request's DMA mapping intact.
>
> Use dma_iova_size() as the unmap length for IOVA mappings so that
> cleanup covers the full range mapped by blk_rq_dma_map_iter_start(),
> even when PRP construction fails.

I don't think this is right. The dma state's iova size was set when it
was allocated, but there are failure scenarios where we've only linked
part of the request. I think the iod's total_len is just not in sync
with the pinned mappings. We should update the total_len as we iterate
the blk_mq_dma_iter, not when we've assigned a PRP element.