Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-17 Thread Steven Price
On 17/12/2021 09:28, Dan Carpenter wrote: > On Fri, Dec 17, 2021 at 09:16:19AM +, Steven Price wrote: >> On 17/12/2021 09:10, Dan Carpenter wrote: >>> On Fri, Dec 17, 2021 at 08:55:50AM +, Steven Price wrote: However this one is harder to fix without setting an arbitrary cap on th

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-17 Thread Dan Carpenter
On Fri, Dec 17, 2021 at 09:16:19AM +, Steven Price wrote: > On 17/12/2021 09:10, Dan Carpenter wrote: > > On Fri, Dec 17, 2021 at 08:55:50AM +, Steven Price wrote: > >> However this one is harder to fix without setting an arbitrary cap on > >> the number of BOs during a sumbit. I'm not sure

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-17 Thread Steven Price
On 17/12/2021 09:10, Dan Carpenter wrote: > On Fri, Dec 17, 2021 at 08:55:50AM +, Steven Price wrote: >> However this one is harder to fix without setting an arbitrary cap on >> the number of BOs during a sumbit. I'm not sure how other drivers handle >> this - the ones I've looked at so far all

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-17 Thread Dan Carpenter
On Fri, Dec 17, 2021 at 08:55:50AM +, Steven Price wrote: > However this one is harder to fix without setting an arbitrary cap on > the number of BOs during a sumbit. I'm not sure how other drivers handle > this - the ones I've looked at so far all have the same issue. There's > obviously the l

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-17 Thread Steven Price
On 16/12/2021 17:49, Alyssa Rosenzweig wrote: >> This provides an easy method for user >> space to trigger the OOM killer (by temporarily allocating large amounts >> of kernel memory) > > panfrost user space has a lot of easy ways to trigger to the OOM killer > unfortunately if this is someth

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-17 Thread Steven Price
On 16/12/2021 17:12, Rob Herring wrote: > On Thu, Dec 16, 2021 at 10:16 AM Steven Price wrote: >> >> panfrost_copy_in_sync() takes the number of fences from user space >> (in_sync_count) and used to kvmalloc() an array to hold that number of >> fences before processing them. This provides an easy

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-16 Thread Tomeu Vizoso
On 12/16/21 6:49 PM, Alyssa Rosenzweig wrote: This provides an easy method for user space to trigger the OOM killer (by temporarily allocating large amounts of kernel memory) panfrost user space has a lot of easy ways to trigger to the OOM killer unfortunately if this is something we want

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-16 Thread Dan Carpenter
On Thu, Dec 16, 2021 at 12:49:53PM -0500, Alyssa Rosenzweig wrote: > > This provides an easy method for user > > space to trigger the OOM killer (by temporarily allocating large amounts > > of kernel memory) > > panfrost user space has a lot of easy ways to trigger to the OOM killer > unfortunatel

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-16 Thread Alyssa Rosenzweig
> This provides an easy method for user > space to trigger the OOM killer (by temporarily allocating large amounts > of kernel memory) panfrost user space has a lot of easy ways to trigger to the OOM killer unfortunately if this is something we want to fix there are a lot more patches coming

Re: [PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-16 Thread Rob Herring
On Thu, Dec 16, 2021 at 10:16 AM Steven Price wrote: > > panfrost_copy_in_sync() takes the number of fences from user space > (in_sync_count) and used to kvmalloc() an array to hold that number of > fences before processing them. This provides an easy method for user > space to trigger the OOM kil

[PATCH] drm/panfrost: Avoid user size passed to kvmalloc()

2021-12-16 Thread Steven Price
panfrost_copy_in_sync() takes the number of fences from user space (in_sync_count) and used to kvmalloc() an array to hold that number of fences before processing them. This provides an easy method for user space to trigger the OOM killer (by temporarily allocating large amounts of kernel memory) o