Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] iommu: unaligned len triggers un-ratelimited pr_err() log spam in iommu_map_sgtable_dma --
commit b1535b935267283d387d7d45e27e3ad27be6e57f Author: Karl Mehltretter <[email protected]> iommu: Add iommu_map_sgtable_dma() This commit adds an iommu-dma helper to map a live attachment into another domain by translating through the device's default DMA domain. > diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c > index 58c624513cd43..b9a1f91ec5dbb 100644 > --- a/drivers/iommu/dma-iommu.c > +++ b/drivers/iommu/dma-iommu.c [ ... ] > +ssize_t iommu_map_sgtable_dma(struct iommu_domain *domain, unsigned long > iova, > + struct device *dev, struct sg_table *sgt, > + int prot) > +{ > + struct iommu_domain *dma_domain; > + size_t len = 0, mapped = 0, total = 0; > + struct scatterlist *sg; > + size_t granule, target_granule; [ ... ] > + target_granule = 1UL << __ffs(domain->pgsize_bitmap); > + if (!use_dma_iommu(dev)) > + return -EOPNOTSUPP; > + dma_domain = iommu_get_dma_domain(dev); > + if (!dma_domain || !dma_domain->pgsize_bitmap) > + return -EOPNOTSUPP; > + granule = min(target_granule, > + 1UL << __ffs(dma_domain->pgsize_bitmap)); [ ... ] > + for_each_sgtable_dma_sg(sgt, sg, i) { > + dma_addr_t dma_addr = sg_dma_address(sg); > + size_t dma_len = sg_dma_len(sg); > + > + while (dma_len) { > + phys_addr_t next; > + phys_addr_t phys; > + > + phys = iommu_iova_to_phys(dma_domain, dma_addr); [ ... ] > + if (len && phys != next) { > + ret = iommu_map_nosync(domain, iova + mapped, > + start, len, prot, > + GFP_KERNEL); [Severity: Medium] Can this result in un-ratelimited kernel log spam if `len` is not aligned to the target domain's minimum page size? If `dma_domain` has a smaller minimum page size than the target `domain`, `granule` will be strictly less than `target_granule`. If the DMA-BUF backing memory is fragmented at `granule` boundaries, `phys != next` will evaluate to true at an offset aligned to `granule` but potentially unaligned to `target_granule`. When `iommu_map_nosync()` is called with this unaligned `len`, it eventually reaches `__iommu_map_domain_pgtbl()` in drivers/iommu/iommu.c, which logs an un-ratelimited error: drivers/iommu/iommu.c:__iommu_map_domain_pgtbl() { ... if (!IS_ALIGNED(iova | paddr | size, min_pagesz)) { pr_err("unaligned: iova 0x%lx pa %pa size 0x%zx min_pagesz 0x%x\n", iova, &paddr, size, min_pagesz); return -EINVAL; } ... } Could a heavily fragmented DMA-BUF provided by userspace (e.g., via a DRM ioctl) repeatedly trigger this path and flood the kernel log? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
