From patchwork Tue Oct 29 20:55:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mina Almasry X-Patchwork-Id: 13855501 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B4B1208989 for ; Tue, 29 Oct 2024 20:55:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1730235333; cv=none; b=lgpCwr01LwqJGtYwRpZv67oj3rsiZ0LyLcqIHb/qyQbkZ//HguoiDOUJUQfxsBUSMrCIjWhkFbgBVrpRqQ0p93QNNM/8qF3nacsqBnqGMrsvGO194SxUSEf6FcsWat+6jnb2rOie3NK+/nVWYhSDYdsOwALqWzdDz+Ylqr1p+Tc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1730235333; c=relaxed/simple; bh=mQ6IINwbv+WqN8eNzea0/anvNw/9DICQ4rWqPuw7YWQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fmvz6alG97GxMmnnk6uUFjDcPddV2U/haGfDxNYuKI4ImwPhEUOIGMXA85/SPOu50dSVamnC4vO4LZQJ8MjciIPSe6DJqnea34LlLdBsmXEgqBqFE69G7q9ocDqbPvlPze3yY39ZZMTWH3OD8M0jP6v/V2NGvad4+va/Ycwk1p4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=n0gZIR53; arc=none smtp.client-ip=209.85.219.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="n0gZIR53" Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-e29205f6063so10125180276.1 for ; Tue, 29 Oct 2024 13:55:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1730235330; x=1730840130; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=bKpRCsSetJLLXlDYxzCijv6xVtSe3eCBCnbKb8kuBnA=; b=n0gZIR53ZEh5948T2NT5Vtz5gI9lNdqRir/X+O1P5EcN01YFb3GiY7XgkHwoKewjbe WcSu7P8lYVj/VRxsTfqRXQFURPG7Idvp2DpC09XNloM93JG79HvaJks+qGzWLANH4Es4 uO8G2lEdJ1Kpt9IIJ0f3WlR1s1YZcDNW3wnnguGIi72ukVDe5bXlICtMdyw585bmhUuw +GrMyjHnvZzQBIfSNyo3ZE1E0XvkAlywhO8bptDKAQ4WwthvNVTDwB6qJGvuYbnnWTOJ 8tveQFDLx3e4GEtsPMHZlKpfs8goTs60YMqXxr2jLT1O2wA2tZTs9LE6j6b75NqBEjE8 zgPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1730235330; x=1730840130; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=bKpRCsSetJLLXlDYxzCijv6xVtSe3eCBCnbKb8kuBnA=; b=ZVQHzG98RRY6fQF4NV2NX0eKHjG5CEc09D2ik363MgHLI3cjYdPCSh9ZtxG87U+pCa v0Iebs2Pio4c3pPd3wHq1eWhW/fEwyNATRvIxRkkMxPe15kzJyVcAGG+0F40T9pWR985 lsssiKRpXDTP6AzDyNt3LXbHvWxzWBoKyM8aJVHDH6vpO8MNdrL6yfS2r8+KpqeTiPfd 8KJLcz/n6fHGymxFO/48CZ5J6TKyoW7pJeEixJZcJeX9AEruP4NROdoCjQSgAkN97gIH ng5h7+SJggNa3mKpx5wGpKSZSBUq1vVKgkd+4cit5ibPv2YEQy51ke6sT1erTCnCjKXc F3Fg== X-Gm-Message-State: AOJu0Yyangrp26Vz7hj34VLnQL2KHSU414lReazZxqT8dgMA8dZWSWtI FlzxvRUyTZjhMxwP3/OLekGXcHFErqQ8oJ/hY3utdwvsKC7dGns32PSTUMh180KroqsfdvVAq6E ENsVpwgxTWUarG2QXzA6fMfHgd4kZfwwC+5db2lOk9BCzNSc+8nkJYucK9k/W/6wRi60IKG7LLw NqQffOhntOcDgHjbbeJUCu9a44ZokzyYPoUvfYbMq08Kn0FRWBtPZ1zJyWkoo= X-Google-Smtp-Source: AGHT+IEE7dLJq88/f4VVbxU0VfsyGl1ZHgwa5wCblziyZGTjJhsrP38TX70qH8bVr1KXcQFHnEzpeHyoZA5aeIAonQ== X-Received: from almasrymina.c.googlers.com ([fda3:e722:ac3:cc00:20:ed76:c0a8:4bc5]) (user=almasrymina job=sendgmr) by 2002:a25:c78a:0:b0:e17:8e4f:981a with SMTP id 3f1490d57ef6-e3087c2d8b1mr69573276.11.1730235329787; Tue, 29 Oct 2024 13:55:29 -0700 (PDT) Date: Tue, 29 Oct 2024 20:55:21 +0000 In-Reply-To: <20241029205524.1306364-1-almasrymina@google.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20241029205524.1306364-1-almasrymina@google.com> X-Mailer: git-send-email 2.47.0.163.g1226f6d8fa-goog Message-ID: <20241029205524.1306364-2-almasrymina@google.com> Subject: [PATCH net-next v1 6/7] net: fix SO_DEVMEM_DONTNEED looping too long From: Mina Almasry To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Cc: Mina Almasry , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Jesper Dangaard Brouer , Ilias Apalodimas , Shuah Khan , Yi Lai X-Patchwork-Delegate: kuba@kernel.org Check we're going to free a reasonable number of frags in token_count before starting the loop, to prevent looping too long. Also minor code cleanups: - Flip checks to reduce indentation. - Use sizeof(*tokens) everywhere for consistentcy. Cc: Yi Lai Signed-off-by: Mina Almasry --- net/core/sock.c | 46 ++++++++++++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 18 deletions(-) -- 2.47.0.163.g1226f6d8fa-goog diff --git a/net/core/sock.c b/net/core/sock.c index 7f398bd07fb7..8603b8d87f2e 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1047,11 +1047,12 @@ static int sock_reserve_memory(struct sock *sk, int bytes) #ifdef CONFIG_PAGE_POOL -/* This is the number of tokens that the user can SO_DEVMEM_DONTNEED in +/* This is the number of frags that the user can SO_DEVMEM_DONTNEED in * 1 syscall. The limit exists to limit the amount of memory the kernel - * allocates to copy these tokens. + * allocates to copy these tokens, and to prevent looping over the frags for + * too long. */ -#define MAX_DONTNEED_TOKENS 128 +#define MAX_DONTNEED_FRAGS 1024 static noinline_for_stack int sock_devmem_dontneed(struct sock *sk, sockptr_t optval, unsigned int optlen) @@ -1059,43 +1060,52 @@ sock_devmem_dontneed(struct sock *sk, sockptr_t optval, unsigned int optlen) unsigned int num_tokens, i, j, k, netmem_num = 0; struct dmabuf_token *tokens; netmem_ref netmems[16]; + u64 num_frags = 0; int ret = 0; if (!sk_is_tcp(sk)) return -EBADF; - if (optlen % sizeof(struct dmabuf_token) || - optlen > sizeof(*tokens) * MAX_DONTNEED_TOKENS) + if (optlen % sizeof(*tokens) || + optlen > sizeof(*tokens) * MAX_DONTNEED_FRAGS) return -EINVAL; - tokens = kvmalloc_array(optlen, sizeof(*tokens), GFP_KERNEL); + num_tokens = optlen / sizeof(*tokens); + tokens = kvmalloc_array(num_tokens, sizeof(*tokens), GFP_KERNEL); if (!tokens) return -ENOMEM; - num_tokens = optlen / sizeof(struct dmabuf_token); if (copy_from_sockptr(tokens, optval, optlen)) { kvfree(tokens); return -EFAULT; } + for (i = 0; i < num_tokens; i++) { + num_frags += tokens[i].token_count; + if (num_frags > MAX_DONTNEED_FRAGS) { + kvfree(tokens); + return -E2BIG; + } + } + xa_lock_bh(&sk->sk_user_frags); for (i = 0; i < num_tokens; i++) { for (j = 0; j < tokens[i].token_count; j++) { netmem_ref netmem = (__force netmem_ref)__xa_erase( &sk->sk_user_frags, tokens[i].token_start + j); - if (netmem && - !WARN_ON_ONCE(!netmem_is_net_iov(netmem))) { - netmems[netmem_num++] = netmem; - if (netmem_num == ARRAY_SIZE(netmems)) { - xa_unlock_bh(&sk->sk_user_frags); - for (k = 0; k < netmem_num; k++) - WARN_ON_ONCE(!napi_pp_put_page(netmems[k])); - netmem_num = 0; - xa_lock_bh(&sk->sk_user_frags); - } - ret++; + if (!netmem || WARN_ON_ONCE(!netmem_is_net_iov(netmem))) + continue; + + netmems[netmem_num++] = netmem; + if (netmem_num == ARRAY_SIZE(netmems)) { + xa_unlock_bh(&sk->sk_user_frags); + for (k = 0; k < netmem_num; k++) + WARN_ON_ONCE(!napi_pp_put_page(netmems[k])); + netmem_num = 0; + xa_lock_bh(&sk->sk_user_frags); } + ret++; } }