linux-kernel - Re: [PATCH] swiotlb: check alloc_size before the allocation of a new memory pool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 8 Jan 2024 16:46:35 +0100
From: Petr Tesarik <petr.tesarik1@...wei-partners.com>
To: Peng Zhang <zhangpeng362@...wei.com>, <hch@....de>,
	<m.szyprowski@...sung.com>, <robin.murphy@....com>, <iommu@...ts.linux.dev>,
	<linux-kernel@...r.kernel.org>
CC: <wangkefeng.wang@...wei.com>, <sunnanyong@...wei.com>
Subject: Re: [PATCH] swiotlb: check alloc_size before the allocation of a new
 memory pool

On 1/8/2024 3:00 PM, Peng Zhang wrote:
> From: ZhangPeng <zhangpeng362@...wei.com>
> 
> The allocation request for swiotlb contiguous memory greater than
> 128*2KB cannot be fulfilled because it exceeds the maximum contiguous
> memory limit. If the swiotlb memory we allocate is larger than 128*2KB,
> swiotlb_find_slots() will still schedule the allocation of a new memory
> pool, which will increase memory overhead.
> 
> Fix it by adding a check with alloc_size no more than 128*2KB before
> scheduling the allocation of a new memory pool in swiotlb_find_slots().
> 
> Signed-off-by: ZhangPeng <zhangpeng362@...wei.com>
> ---
>  kernel/dma/swiotlb.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
> index 33d942615be5..cc92cff02c60 100644
> --- a/kernel/dma/swiotlb.c
> +++ b/kernel/dma/swiotlb.c
> @@ -1126,6 +1126,9 @@ static int swiotlb_find_slots(struct device *dev, phys_addr_t orig_addr,
>  	u64 phys_limit;
>  	int index;
>  
> +	if (alloc_size > IO_TLB_SEGSIZE * IO_TLB_SIZE)
> +		return -1;
> +
>  	rcu_read_lock();
>  	list_for_each_entry_rcu(pool, &mem->pools, node) {
>  		index = swiotlb_pool_find_slots(dev, pool, orig_addr,

IIUC this such big allocations are not normally required by drivers, but
I have already run into a similar issue with a Raspberry Pi 4 dma-buf
object, so they can be triggered at will by user space. I also believe
this sanity check is a good idea in general, not only when dynamic
SWIOTLB is enabled.

Reviewed-by: Petr Tesarik <petr.tesarik1@...wei-partners.com>

Petr T