get_sg_table() merges physically contiguous pages without accounting
for the mapping device's maximum segment size. This affects both
importer mappings and the udmabuf misc device mapping used for CPU
access.
With DMA_API_DEBUG enabled, DMA_BUF_IOCTL_SYNC on a 64 MiB udmabuf
reports:
DMA-API: misc udmabuf: mapping sg segment longer than device claims to
support [len=65884160] [max=65536]
Use sg_alloc_table_from_pages_segment() with the mapping device's
maximum segment size. Return -EINVAL if the limit is smaller than
PAGE_SIZE because the page-based allocator cannot honor it.
Before commit 5bf888673e0d ("udmabuf: Do not create malformed
scatterlists"), each entry covered one page.
Fixes: 5bf888673e0d ("udmabuf: Do not create malformed scatterlists")
Reviewed-by: Jason Gunthorpe <[email protected]>
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <[email protected]>
---
Notes:
Changes in v2:
- Return -EINVAL when the maximum segment size reported by the device is
smaller than PAGE_SIZE instead of clamping it. (Christian)
- Add Jason Gunthorpe's Reviewed-by tag.
Tested on v7.3-rc4-70-gfe2ec83746e5 in QEMU (x86_64, TCG) with
DMA_API_DEBUG (all_errors=1) and DMABUF_DEBUG, A/B against the same
base:
before after
DMA_BUF_IOCTL_SYNC, 64 MiB udmabuf 1 report 0
vivid import, 4 MiB udmabuf 2 reports 0
vivid import, 2 MiB hugetlb udmabuf 2 reports 0
frames captured 5/5 5/5
vb2-dma-contig rejected the non-contiguous import in both runs.
For v2, a focused importer advertising PAGE_SIZE / 2 returned
-EINVAL under KASAN and DMA_API_DEBUG. No warning, BUG, or DMA-API
report was emitted.
drivers/dma-buf/udmabuf.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index df6dd00462423..018937435356e 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -133,15 +133,22 @@ static struct sg_table *get_sg_table(struct device *dev,
struct dma_buf *buf,
{
struct udmabuf *ubuf = buf->priv;
struct sg_table *sg;
+ unsigned int max_segment;
int ret;
+ max_segment = dma_get_max_seg_size(dev);
+ /* The SG allocator requires a segment limit of at least PAGE_SIZE. */
+ if (max_segment < PAGE_SIZE)
+ return ERR_PTR(-EINVAL);
+
sg = kzalloc_obj(*sg);
if (!sg)
return ERR_PTR(-ENOMEM);
- ret = sg_alloc_table_from_pages(sg, ubuf->pages, ubuf->pagecount, 0,
- ubuf->pagecount << PAGE_SHIFT,
- GFP_KERNEL);
+ ret = sg_alloc_table_from_pages_segment(sg, ubuf->pages,
ubuf->pagecount,
+ 0, ubuf->pagecount <<
PAGE_SHIFT,
+ max_segment,
+ GFP_KERNEL);
if (ret < 0)
goto err_alloc;
base-commit: fe2ec83746e501645709761605c2464a44fd2929
--
2.53.0
