From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B8DF428EE for ; Mon, 2 Jan 2023 11:27:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4296EC433D2; Mon, 2 Jan 2023 11:27:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1672658823; bh=K1PhWsGbQ5gNgxpKSIIlbiJAhdzV+dwMm3aemV00wSU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tef9CF6b6vkAmvVgnG8bJpapexleEUgBHCLxHpdseRp9ynQgjFk60Untx53URS/yt m9+3bplwz57m/sdn9e5sSVffBGXu2JZbWgbhf1iiWhUj7yylnkIl+cOxv+rwZRlAMj BfrkGamSrhJlry+n6qhPzupje+iKK06UDByVhJZ4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jens Axboe , Keith Busch , Kanchan Joshi , Chaitanya Kulkarni , Christoph Hellwig , Sasha Levin Subject: [PATCH 6.0 13/74] nvme-pci: fix mempool alloc size Date: Mon, 2 Jan 2023 12:21:46 +0100 Message-Id: <20230102110552.605423337@linuxfoundation.org> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230102110552.061937047@linuxfoundation.org> References: <20230102110552.061937047@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Keith Busch [ Upstream commit c89a529e823d51dd23c7ec0c047c7a454a428541 ] Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. Cc: Jens Axboe Fixes: 943e942e6266f ("nvme-pci: limit max IO size and segments to avoid high order allocations") Signed-off-by: Keith Busch Reviewed-by: Jens Axboe Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin --- drivers/nvme/host/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 0b97e8ce13e4..b128e2e36b68 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -378,8 +378,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, */ static int nvme_pci_npages_prp(void) { - unsigned nprps = DIV_ROUND_UP(NVME_MAX_KB_SZ + NVME_CTRL_PAGE_SIZE, - NVME_CTRL_PAGE_SIZE); + unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; + unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); } -- 2.35.1