Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH v6 RESEND] dma-buf: system_heap: Add a size check for
 allocation
To:     guangming.cao@mediatek.com
Cc:     benjamin.gaignard@linaro.org, bo.song@mediatek.com,
        caoguangming34@gmail.com, dri-devel@lists.freedesktop.org,
        jianjiao.zeng@mediatek.com, john.stultz@linaro.org,
        labbott@redhat.com, libo.kang@mediatek.com,
        linaro-mm-sig@lists.linaro.org,
        linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
        linux-media@vger.kernel.org, linux-mediatek@lists.infradead.org,
        lmark@codeaurora.org, matthias.bgg@gmail.com,
        michael.j.ruhl@intel.com, mingyuan.ma@mediatek.com,
        sumit.semwal@linaro.org, wsd_upstream@mediatek.com,
        yf.wang@mediatek.com
References: <20220120085259.98147-1-guangming.cao@mediatek.com>
 <20220120100036.99867-1-guangming.cao@mediatek.com>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
Message-ID: <90bf495d-dbf6-cb0d-f54f-e0080b810f8d@amd.com>
Date:   Thu, 20 Jan 2022 11:22:10 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
In-Reply-To: <20220120100036.99867-1-guangming.cao@mediatek.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Y0J2ZGdEZHhOb0dLaVhlTkJ3c0M0NzRMNTNKZ3JkSktUK2ppemV3MktURVVK?=
 =?utf-8?B?cW14VDZYVmt1eXYveW55TGpTR2Qvb0JkWWZySWdtK3lEdHh6ekVqSm5WM2or?=
 =?utf-8?B?Q3FhL2VQampxb1BqRVdkT0N1Z25OVktsZmwzWmpEemZqVGsrNk9MLzlic1dI?=
 =?utf-8?B?L3ZnUUdnR0U2TU1EUzljVUxiNnVWOEdFemNheXFodkZQTCsrRWhLS1dkTnB5?=
 =?utf-8?B?VTFVUGdXeVUrbjhmZk5YaHM1YlZjWWJCYW1pUUs0U2J3ZW1NcFBYRlhjcVZk?=
 =?utf-8?B?R0NLNkFFNHl6a3BrMDNuTjN5bUtEcWduOVp0SGJxRkhkQ1cvcEFwLysxQ01F?=
 =?utf-8?B?cldPdzdJSlRTTUw1Z2hOakVSblI1S2pDMW84Q2QwUjd2WHdWSm9pOXZ0Z3ls?=
 =?utf-8?B?dHNPdTYwR0RWa3BHQ3Q3VHpJeUFIZENueGNWTWhHZEVLTjc3bUJyeUZrNWt3?=
 =?utf-8?B?dzd4Q29KTlhONW0zc211Y1MwNkd1L0hmZEFFVmVXOFhVSEJRVGZvOHNvVHhh?=
 =?utf-8?B?aGkyTVpZMmFmOWpYR2h2MnExU0g2ejRnV1ZiTVRSZjd5TTZKbGFLZDBjdjh3?=
 =?utf-8?B?bDRPTm95VXhyV25lMzVNMEJXd2lCMDR1NnNVYUZYYWRxRXFab0tRL1BhWlN2?=
 =?utf-8?B?b3F2Q3RWZ2dheUp1a1JvdlhFMkI3TXh2ZFdlNmgvaWpmclRvcUpvcmpzVy9Q?=
 =?utf-8?B?R09kZFBzOUhrVjNlNHhFeTZ2NFZUcnhZQS9ySlcxZ1RhZGdWWEpkNTJsbUlM?=
 =?utf-8?B?azJ6Vk0ySUFpNGY3Vjc2MGpWRytKbERNK01kSCtUOEhzcTFiSWV6NjNSOFRp?=
 =?utf-8?B?clVXVXdObWFMY3pCM3I3eEl0Y2hhMU9LZHdjN2w1MFduUmhRZHNwbUEyL2pS?=
 =?utf-8?B?cFo0Z2p4NEgyVEk2cktkZkNDU1NwT2J3eU5PS0piODFPQ0VnVG1lOVF3OEgy?=
 =?utf-8?B?ZjlGTVU3MjduY3d1c08zaG0yZHdsek1ZSmZnWjNEbWg5RkVQSHFYOEU2WDVp?=
 =?utf-8?B?MXFUeHV4MnpwNXQ3UmlwRkd5N0FoQUNwZFc4bmxnaCtnOEVISGZUcDJnRklC?=
 =?utf-8?B?V1ZBQWRkVTk2K2JRYWRtZEdSdzM1RlJvU09SVSszYjljVnNsS0F6ZVp6S1gw?=
 =?utf-8?B?Rnk5Qmp6OHh5QVZxRU9ON1RUeEpobXhrV2ZEdDRydExyTHdKV2p4ZUtVQXow?=
 =?utf-8?B?dmVhWXB3YjRYVFNFZVE4YmVVNkRiSC9TYlljejY4T2dXNTA2M1ovQ2Z3c0pN?=
 =?utf-8?B?QVQrQVdqR3JpeFNTRitYK0JrWWQ5UDMydlpZYTAzYlhHdUtPK2pqZWNzYnNz?=
 =?utf-8?B?dkZwbjI5NjBBN3AwbEFqRDNSaUV6Tm1VN09mcVNyTzNrM1VOWU1qdE9YV3dU?=
 =?utf-8?B?TkdBU2lFSGxEa0k4ZnNHN3V3RGpCS1lXQTB3OUZBMWw3aTlnUXNhZW9iWlEy?=
 =?utf-8?B?N2JmdWoxTHFxZ1c2ZklOUE9pb2FBUy9ZTmZVVmllM1o4QVpNT0J5VHNVcEVL?=
 =?utf-8?B?ZFlzUUNESVF6WEhYUUJoUWxpMHZVbXFGTHNEcWRQRkZ6Z01ZNkx3bTRXRzFN?=
 =?utf-8?B?RjNlNkU1WGVDbjlVcjRyRDQzZVBndjFnZW5RWmxvYU5VNnRBa2xhMnkvaHRH?=
 =?utf-8?B?a2RnSCtLNjFxdGp4T3hqLzV6WFJ1YitnQ2tGZGVuREFtMEk3Yk55Yys3aWY5?=
 =?utf-8?B?TzRUeklWeUhaeGFFeHZrK0FhZjZtcDRIc0ZqblVpQzJhNk1ydEZkU2VlQ0xN?=
 =?utf-8?B?QTFibTAwZzBuNHZ1V1pEb0hsR0pQZWR2MkcyU0JFZllmTGdOc0NOMU1ya240?=
 =?utf-8?B?bTlXT1A0NmhrMUNQYitMWklEVkJmdnNxc0hjeU1DZHc5eUlKUTdaV3VOZzZo?=
 =?utf-8?B?T2pET3VnYzUzaEJCVlFvOEk1S2RjdkpuOHVWVXZSamtkNTFxS0VZeE5WOTdm?=
 =?utf-8?B?TjVSOU5vWG52Zk9IWEhBYmZTZTRCeXcwZ2YwSmgxajdOaWlmTjBRc2lYelN4?=
 =?utf-8?B?YW42bTBRM3gxclFGdmRNa0RKUE5CUGl6ckg0UjZ4d3BhalRSVnNuUjEzUFlV?=
 =?utf-8?B?T2dnV3hhL3FaYXM5T2lLM05MaUJtU3FjcWtYaGlaRHJtaUJVNkpHbzVlb2do?=
 =?utf-8?Q?BSNE=3D?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 32982818-4275-453d-e497-08d9dbfebc61
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2022 10:22:18.2093
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ms1hohte1qwfdHRYIOA6Iws6bP6AlOhJ7XcIFzZvCTHivIJlR/u5fxriQARp5LfW
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB4672
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 20.01.22 um 11:00 schrieb guangming.cao@mediatek.com:
> From: Guangming <Guangming.Cao@mediatek.com>
>
> Add a size check for allocation since the allocation size should be
> always less than the total DRAM size on system heap.
> Adding this check can prevent comsuming too much time for invalid allocations.
>
> Signed-off-by: Guangming <Guangming.Cao@mediatek.com>
> Acked-by: John Stultz <john.stultz@linaro.org>

Acked-by: Christian König <christian.koenig@amd.com>

> ---
>   drivers/dma-buf/heaps/system_heap.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
>
> diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
> index 23a7e74ef966..b65e597a742f 100644
> --- a/drivers/dma-buf/heaps/system_heap.c
> +++ b/drivers/dma-buf/heaps/system_heap.c
> @@ -347,6 +347,14 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,
>   	struct page *page, *tmp_page;
>   	int i, ret = -ENOMEM;
>   
> +	/*
> +	 * Size check. The "len" should be less than totalram since system_heap
> +	 * memory is comes from system. Adding check here can prevent comsuming
> +	 * too much time for invalid allocations.
> +	 */
> +	if (PFN_DOWN(len) > totalram_pages())
> +		return ERR_PTR(-EINVAL);
> +
>   	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
>   	if (!buffer)
>   		return ERR_PTR(-ENOMEM);