From nobody Mon Nov 25 06:45:35 2024 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3D0020897B for ; Tue, 29 Oct 2024 20:55:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1730235333; cv=none; b=lgpCwr01LwqJGtYwRpZv67oj3rsiZ0LyLcqIHb/qyQbkZ//HguoiDOUJUQfxsBUSMrCIjWhkFbgBVrpRqQ0p93QNNM/8qF3nacsqBnqGMrsvGO194SxUSEf6FcsWat+6jnb2rOie3NK+/nVWYhSDYdsOwALqWzdDz+Ylqr1p+Tc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1730235333; c=relaxed/simple; bh=mQ6IINwbv+WqN8eNzea0/anvNw/9DICQ4rWqPuw7YWQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fmvz6alG97GxMmnnk6uUFjDcPddV2U/haGfDxNYuKI4ImwPhEUOIGMXA85/SPOu50dSVamnC4vO4LZQJ8MjciIPSe6DJqnea34LlLdBsmXEgqBqFE69G7q9ocDqbPvlPze3yY39ZZMTWH3OD8M0jP6v/V2NGvad4+va/Ycwk1p4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=n0gZIR53; arc=none smtp.client-ip=209.85.219.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="n0gZIR53" Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-e0b8fa94718so10600799276.0 for ; Tue, 29 Oct 2024 13:55:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1730235330; x=1730840130; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=bKpRCsSetJLLXlDYxzCijv6xVtSe3eCBCnbKb8kuBnA=; b=n0gZIR53ZEh5948T2NT5Vtz5gI9lNdqRir/X+O1P5EcN01YFb3GiY7XgkHwoKewjbe WcSu7P8lYVj/VRxsTfqRXQFURPG7Idvp2DpC09XNloM93JG79HvaJks+qGzWLANH4Es4 uO8G2lEdJ1Kpt9IIJ0f3WlR1s1YZcDNW3wnnguGIi72ukVDe5bXlICtMdyw585bmhUuw +GrMyjHnvZzQBIfSNyo3ZE1E0XvkAlywhO8bptDKAQ4WwthvNVTDwB6qJGvuYbnnWTOJ 8tveQFDLx3e4GEtsPMHZlKpfs8goTs60YMqXxr2jLT1O2wA2tZTs9LE6j6b75NqBEjE8 zgPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1730235330; x=1730840130; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=bKpRCsSetJLLXlDYxzCijv6xVtSe3eCBCnbKb8kuBnA=; b=BBuG0wh3YPCGaJIUb4xWKr/bQbTmD+XIYOabymd7q1dSSsnSn3vzvq9//jOSL8QfsT c2H+frL/N+Ktc/mATyCxtemEHkwJlHYc+BqoHi0TcFau13TxUu5BlVyC7ODzT6tNiRho pIpC3osIBL1PMR8jzrvCED8I3gceYA3MAjhlpQVuXLij3aLj8Kvbak2t59Y2q3j6RJ3o wVM0J9V46/tOxF+eJ4PZSWfAPPQ5ZI9cdDjF4Q9pr4HEMXOE93EbeLquTv7aNeKbWhpt 7H/OCh9RnMmvRJGs/7qxj+Q8Cxm28iWPepelGv0Dtzr+2a5G2H8dVPQ078pnURRJzu93 rw+A== X-Forwarded-Encrypted: i=1; AJvYcCW12KtRjzpuqDmriZ8ju+sysd0OtY+gzJJ2AFdKgZufQoLSWCwx/UpWqkCwXfOUiJ0tEJ+RjWjC2sewbXM=@vger.kernel.org X-Gm-Message-State: AOJu0Ywa+dfvxYWu/knhGXpJUJicP7p4SOEk5fkvhgp/+lc9Ysvjgvnt fUJ1746ToiLLwTYNIxTuKG5oFUBa5RY5wLgAi6XyfMok4fq6x6P9LDnpIQ5XSjTxut1tpspG42F iwhac89pokhWkmKPJM/ub6w== X-Google-Smtp-Source: AGHT+IEE7dLJq88/f4VVbxU0VfsyGl1ZHgwa5wCblziyZGTjJhsrP38TX70qH8bVr1KXcQFHnEzpeHyoZA5aeIAonQ== X-Received: from almasrymina.c.googlers.com ([fda3:e722:ac3:cc00:20:ed76:c0a8:4bc5]) (user=almasrymina job=sendgmr) by 2002:a25:c78a:0:b0:e17:8e4f:981a with SMTP id 3f1490d57ef6-e3087c2d8b1mr69573276.11.1730235329787; Tue, 29 Oct 2024 13:55:29 -0700 (PDT) Date: Tue, 29 Oct 2024 20:55:21 +0000 In-Reply-To: <20241029205524.1306364-1-almasrymina@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20241029205524.1306364-1-almasrymina@google.com> X-Mailer: git-send-email 2.47.0.163.g1226f6d8fa-goog Message-ID: <20241029205524.1306364-2-almasrymina@google.com> Subject: [PATCH net-next v1 6/7] net: fix SO_DEVMEM_DONTNEED looping too long From: Mina Almasry To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Cc: Mina Almasry , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Jesper Dangaard Brouer , Ilias Apalodimas , Shuah Khan , Yi Lai Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Check we're going to free a reasonable number of frags in token_count before starting the loop, to prevent looping too long. Also minor code cleanups: - Flip checks to reduce indentation. - Use sizeof(*tokens) everywhere for consistentcy. Cc: Yi Lai Signed-off-by: Mina Almasry --- net/core/sock.c | 46 ++++++++++++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 18 deletions(-) diff --git a/net/core/sock.c b/net/core/sock.c index 7f398bd07fb7..8603b8d87f2e 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1047,11 +1047,12 @@ static int sock_reserve_memory(struct sock *sk, int= bytes) #ifdef CONFIG_PAGE_POOL -/* This is the number of tokens that the user can SO_DEVMEM_DONTNEED in +/* This is the number of frags that the user can SO_DEVMEM_DONTNEED in * 1 syscall. The limit exists to limit the amount of memory the kernel - * allocates to copy these tokens. + * allocates to copy these tokens, and to prevent looping over the frags f= or + * too long. */ -#define MAX_DONTNEED_TOKENS 128 +#define MAX_DONTNEED_FRAGS 1024 static noinline_for_stack int sock_devmem_dontneed(struct sock *sk, sockptr_t optval, unsigned int optle= n) @@ -1059,43 +1060,52 @@ sock_devmem_dontneed(struct sock *sk, sockptr_t opt= val, unsigned int optlen) unsigned int num_tokens, i, j, k, netmem_num =3D 0; struct dmabuf_token *tokens; netmem_ref netmems[16]; + u64 num_frags =3D 0; int ret =3D 0; if (!sk_is_tcp(sk)) return -EBADF; - if (optlen % sizeof(struct dmabuf_token) || - optlen > sizeof(*tokens) * MAX_DONTNEED_TOKENS) + if (optlen % sizeof(*tokens) || + optlen > sizeof(*tokens) * MAX_DONTNEED_FRAGS) return -EINVAL; - tokens =3D kvmalloc_array(optlen, sizeof(*tokens), GFP_KERNEL); + num_tokens =3D optlen / sizeof(*tokens); + tokens =3D kvmalloc_array(num_tokens, sizeof(*tokens), GFP_KERNEL); if (!tokens) return -ENOMEM; - num_tokens =3D optlen / sizeof(struct dmabuf_token); if (copy_from_sockptr(tokens, optval, optlen)) { kvfree(tokens); return -EFAULT; } + for (i =3D 0; i < num_tokens; i++) { + num_frags +=3D tokens[i].token_count; + if (num_frags > MAX_DONTNEED_FRAGS) { + kvfree(tokens); + return -E2BIG; + } + } + xa_lock_bh(&sk->sk_user_frags); for (i =3D 0; i < num_tokens; i++) { for (j =3D 0; j < tokens[i].token_count; j++) { netmem_ref netmem =3D (__force netmem_ref)__xa_erase( &sk->sk_user_frags, tokens[i].token_start + j); - if (netmem && - !WARN_ON_ONCE(!netmem_is_net_iov(netmem))) { - netmems[netmem_num++] =3D netmem; - if (netmem_num =3D=3D ARRAY_SIZE(netmems)) { - xa_unlock_bh(&sk->sk_user_frags); - for (k =3D 0; k < netmem_num; k++) - WARN_ON_ONCE(!napi_pp_put_page(netmems[k])); - netmem_num =3D 0; - xa_lock_bh(&sk->sk_user_frags); - } - ret++; + if (!netmem || WARN_ON_ONCE(!netmem_is_net_iov(netmem))) + continue; + + netmems[netmem_num++] =3D netmem; + if (netmem_num =3D=3D ARRAY_SIZE(netmems)) { + xa_unlock_bh(&sk->sk_user_frags); + for (k =3D 0; k < netmem_num; k++) + WARN_ON_ONCE(!napi_pp_put_page(netmems[k])); + netmem_num =3D 0; + xa_lock_bh(&sk->sk_user_frags); } + ret++; } } -- 2.47.0.163.g1226f6d8fa-goog