From: Jason Gunthorpe <jgg@ziepe.ca>
To: Krzysztof Karas <krzysztof.karas@intel.com>
Cc: "Robin Murphy" <robin.murphy@arm.com>,
intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
iommu@lists.linux.dev, "Andi Shyti" <andi.shyti@linux.intel.com>,
"Joerg Roedel" <joro@8bytes.org>,
"Michał Grzelak" <michal.grzelak@intel.com>,
"Janusz Krzysztofik" <janusz.krzysztofik@linux.intel.com>,
"Sebastian Brzezinka" <sebastian.brzezinka@intel.com>,
"Krzysztof Niemiec" <krzysztof.niemiec@intel.com>
Subject: Re: [PATCH v2 3/3] drivers/iommu: Catch scatterlist length overflows
Date: Mon, 6 Jul 2026 09:31:25 -0300 [thread overview]
Message-ID: <20260706123125.GA107792@ziepe.ca> (raw)
In-Reply-To: <utb5awup2vypdhtcxk3vlczwrqbl3ypae6ftbwrlrkdqfnk4ft@aurl5kme27ac>
On Mon, Jul 06, 2026 at 07:43:14AM +0000, Krzysztof Karas wrote:
> > I agree we shouldn't overcomplicate iommu_dma_map_sg(), so the
> > simplest fix is to introduce a SG_MAX_LENGTH set to UINT_MAX/2,
> > justified by the logic in iommu_dma_map_sg(). Fixup the core sg_alloc
> > code to respect that. WARN_ON in iommu_dma_map_sg() if a malformed
> > scatterlist entry is presented. Add a WARN_ON under DMA debugging
> > kconfig as well for the physical path.
>
> So instead of addressing this in iommu, we should focus on
> guarding in sg logic to prevent the overflows?
You should focus on creating valid scatterlists..
> Or would you rather have this as additional, separate fix placed in
> this series?
I think this patch should be changed to check the length and
WARN_ON. It is a kernel bug to pass a malformed scatterlist.
You'll need other patches before this to not create illegal SGs in
whatever mapping path you are using.
Jason
next prev parent reply other threads:[~2026-07-06 12:31 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-01 10:44 [PATCH v2 0/3] drivers: Improve memory management for large object allocations when i915/shmem is used with iommu Krzysztof Karas
2026-07-01 10:44 ` [PATCH v2 1/3] drm/i915/gem: split shared memory allocation table logic Krzysztof Karas
2026-07-01 14:38 ` Andi Shyti
2026-07-02 6:18 ` Krzysztof Karas
2026-07-02 12:01 ` Robin Murphy
2026-07-01 10:44 ` [PATCH v2 2/3] drm/i915/shmem: Count mapped pages in a folio Krzysztof Karas
2026-07-01 10:44 ` [PATCH v2 3/3] drivers/iommu: Catch scatterlist length overflows Krzysztof Karas
2026-07-01 10:59 ` sashiko-bot
2026-07-01 11:59 ` Robin Murphy
2026-07-02 6:22 ` Krzysztof Karas
2026-07-02 12:17 ` Robin Murphy
2026-07-03 16:22 ` Jason Gunthorpe
2026-07-03 18:58 ` Robin Murphy
2026-07-03 20:35 ` Jason Gunthorpe
2026-07-06 7:43 ` Krzysztof Karas
2026-07-06 12:31 ` Jason Gunthorpe [this message]
2026-07-06 13:08 ` Robin Murphy
2026-07-06 14:45 ` Jason Gunthorpe
2026-07-09 7:18 ` Krzysztof Karas
2026-07-01 15:36 ` [PATCH v2 0/3] drivers: Improve memory management for large object allocations when i915/shmem is used with iommu Andi Shyti
2026-07-02 6:10 ` Krzysztof Karas
2026-07-01 15:44 ` ✓ i915.CI.BAT: success for drivers: Improve memory management for large object allocations when i915/shmem is used with iommu (rev3) Patchwork
2026-07-02 6:33 ` ✓ i915.CI.Full: " Patchwork
2026-07-09 8:23 ` ✗ i915.CI.BAT: failure for drivers: Improve memory management for large object allocations when i915/shmem is used with iommu (rev4) Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260706123125.GA107792@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=andi.shyti@linux.intel.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=iommu@lists.linux.dev \
--cc=janusz.krzysztofik@linux.intel.com \
--cc=joro@8bytes.org \
--cc=krzysztof.karas@intel.com \
--cc=krzysztof.niemiec@intel.com \
--cc=michal.grzelak@intel.com \
--cc=robin.murphy@arm.com \
--cc=sebastian.brzezinka@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.