net/rds: dma_map_sg is entitled to merge entries

Function "dma_map_sg" is entitled to merge adjacent entries
and return a value smaller than what was passed as "nents".

Subsequently "ib_map_mr_sg" needs to work with this value ("sg_dma_len")
rather than the original "nents" parameter ("sg_len").

This old RDS bug was exposed and reliably causes kernel panics
(using RDMA operations "rds-stress -D") on x86_64 starting with:
commit c588072 ("iommu/vt-d: Convert intel iommu driver to the iommu ops")

Simply put: Linux 5.11 and later.

Orabug: 33590097

Signed-off-by: Gerd Rausch <[email protected]>
Reviewed-by: William Kucharski <[email protected]>

Author: gerd-rausch

net/rds/ib_rdma.c

@@ -1547,8 +1547,8 @@ static int rds_ib_map_scatterlist(struct rds_ib_device *rds_ibdev,
 		return -EBUSY;
 	}
 
-	ret = ib_map_mr_sg_zbva(ibmr->mr, sg, sg_len, &off, PAGE_SIZE);
-	if (unlikely(ret != sg_len)) {
+	ret = ib_map_mr_sg_zbva(ibmr->mr, sg, sg_dma_len, &off, PAGE_SIZE);
+	if (unlikely(ret != sg_dma_len)) {
 		ibmr->fr_state = MR_IS_STALE;
 		ret = ret < 0 ? ret : -EINVAL;
 		goto out_unmap;