[PATCH net] net: devmem: reject TX dma-buf with non-page-aligned size or SG length

[PATCH net] net: devmem: reject TX dma-buf with non-page-aligned size or SG length

[David Carlier]

The TX dma-buf bind assumes dmabuf->size and every sg_dma_len() are
PAGE_SIZE multiples: tx_vec is sized dmabuf->size / PAGE_SIZE and
indexed by virt_addr / PAGE_SIZE, with only a virt_addr < dmabuf->size
bound check. A non-page-aligned size lets sendmsg() reach the tail
region past the last populated slot and read one past tx_vec[]. A
non-page-aligned, non-final SG entry causes the same OOB indirectly
by desyncing later slots.

Reject both up front. Real exporters (udmabuf, dma-buf heaps, GPU
drivers) already page-align, so this only refuses layouts the TX path
can't back correctly.

Fixes: bd61848900bf ("net: devmem: Implement TX path")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 net/core/devmem.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/net/core/devmem.c b/net/core/devmem.c
index 468344739db2..e72f48ff9094 100644
--- a/net/core/devmem.c
+++ b/net/core/devmem.c
@@ -193,6 +193,7 @@ net_devmem_bind_dmabuf(struct net_device *dev,
 	struct dma_buf *dmabuf;
 	unsigned int sg_idx, i;
 	unsigned long virtual;
+	bool todevice;
 	int err;
 
 	if (!dma_dev) {
@@ -240,7 +241,14 @@ net_devmem_bind_dmabuf(struct net_device *dev,
 		goto err_detach;
 	}
 
-	if (direction == DMA_TO_DEVICE) {
+	todevice = direction == DMA_TO_DEVICE;
+
+	if (todevice) {
+		if (!IS_ALIGNED(dmabuf->size, PAGE_SIZE)) {
+			err = -EINVAL;
+			NL_SET_ERR_MSG(extack, "TX dma-buf size must be a multiple of PAGE_SIZE");
+			goto err_unmap;
+		}
 		binding->tx_vec = kvmalloc_objs(struct net_iov *,
 						dmabuf->size / PAGE_SIZE);
 		if (!binding->tx_vec) {
@@ -267,6 +275,12 @@ net_devmem_bind_dmabuf(struct net_device *dev,
 		size_t len = sg_dma_len(sg);
 		struct net_iov *niov;
 
+		if (todevice && !IS_ALIGNED(len, PAGE_SIZE)) {
+			err = -EINVAL;
+			NL_SET_ERR_MSG(extack, "TX dma-buf SG length must be PAGE_SIZE aligned");
+			goto err_free_chunks;
+		}
+
 		owner = kzalloc_node(sizeof(*owner), GFP_KERNEL,
 				     dev_to_node(&dev->dev));
 		if (!owner) {
-- 
2.53.0

Re: [PATCH net] net: devmem: reject TX dma-buf with non-page-aligned size or SG length

[Stanislav Fomichev]

On 05/17, David Carlier wrote:
> The TX dma-buf bind assumes dmabuf->size and every sg_dma_len() are
> PAGE_SIZE multiples: tx_vec is sized dmabuf->size / PAGE_SIZE and
> indexed by virt_addr / PAGE_SIZE, with only a virt_addr < dmabuf->size
> bound check. A non-page-aligned size lets sendmsg() reach the tail
> region past the last populated slot and read one past tx_vec[]. A
> non-page-aligned, non-final SG entry causes the same OOB indirectly
> by desyncing later slots.

[..]

> Reject both up front. Real exporters (udmabuf, dma-buf heaps, GPU
> drivers) already page-align, so this only refuses layouts the TX path
> can't back correctly.
> 
> Fixes: bd61848900bf ("net: devmem: Implement TX path")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Carlier <devnexen@gmail.com>

If the real exported already export page-aligned, why does it need
to go into net/stable?

> ---
>  net/core/devmem.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/devmem.c b/net/core/devmem.c
> index 468344739db2..e72f48ff9094 100644
> --- a/net/core/devmem.c
> +++ b/net/core/devmem.c
> @@ -193,6 +193,7 @@ net_devmem_bind_dmabuf(struct net_device *dev,
>  	struct dma_buf *dmabuf;
>  	unsigned int sg_idx, i;
>  	unsigned long virtual;
> +	bool todevice;
>  	int err;
>  
>  	if (!dma_dev) {
> @@ -240,7 +241,14 @@ net_devmem_bind_dmabuf(struct net_device *dev,
>  		goto err_detach;
>  	}
>  
> -	if (direction == DMA_TO_DEVICE) {
> +	todevice = direction == DMA_TO_DEVICE;

If you're being defensive here with "real exporters already page-align",
why not do this check on both rx and tx? Why single out tx side?

Re: [PATCH net] net: devmem: reject TX dma-buf with non-page-aligned size or SG length

[Bobby Eshleman]

On Sun, May 17, 2026 at 09:18:14PM +0100, David Carlier wrote:
> The TX dma-buf bind assumes dmabuf->size and every sg_dma_len() are
> PAGE_SIZE multiples: tx_vec is sized dmabuf->size / PAGE_SIZE and
> indexed by virt_addr / PAGE_SIZE, with only a virt_addr < dmabuf->size
> bound check. A non-page-aligned size lets sendmsg() reach the tail
> region past the last populated slot and read one past tx_vec[]. A
> non-page-aligned, non-final SG entry causes the same OOB indirectly
> by desyncing later slots.
> 
> Reject both up front. Real exporters (udmabuf, dma-buf heaps, GPU
> drivers) already page-align, so this only refuses layouts the TX path
> can't back correctly.
> 
> Fixes: bd61848900bf ("net: devmem: Implement TX path")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Carlier <devnexen@gmail.com>
> ---
>  net/core/devmem.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/devmem.c b/net/core/devmem.c
> index 468344739db2..e72f48ff9094 100644
> --- a/net/core/devmem.c
> +++ b/net/core/devmem.c
> @@ -193,6 +193,7 @@ net_devmem_bind_dmabuf(struct net_device *dev,
>  	struct dma_buf *dmabuf;
>  	unsigned int sg_idx, i;
>  	unsigned long virtual;
> +	bool todevice;
>  	int err;
>  
>  	if (!dma_dev) {
> @@ -240,7 +241,14 @@ net_devmem_bind_dmabuf(struct net_device *dev,
>  		goto err_detach;
>  	}
>  
> -	if (direction == DMA_TO_DEVICE) {
> +	todevice = direction == DMA_TO_DEVICE;

nit: this code already has precedent for comparing direction directly to
DMA_TO_DEVICE in line, so probably don't need to store in a new
variable. The binding->tx_vec[] assignment down near line 300 also does
this and is missed in this conversion.

Best,
Bobby

> +
> +	if (todevice) {
> +		if (!IS_ALIGNED(dmabuf->size, PAGE_SIZE)) {
> +			err = -EINVAL;
> +			NL_SET_ERR_MSG(extack, "TX dma-buf size must be a multiple of PAGE_SIZE");
> +			goto err_unmap;
> +		}
>  		binding->tx_vec = kvmalloc_objs(struct net_iov *,
>  						dmabuf->size / PAGE_SIZE);
>  		if (!binding->tx_vec) {
> @@ -267,6 +275,12 @@ net_devmem_bind_dmabuf(struct net_device *dev,
>  		size_t len = sg_dma_len(sg);
>  		struct net_iov *niov;
>  
> +		if (todevice && !IS_ALIGNED(len, PAGE_SIZE)) {
> +			err = -EINVAL;
> +			NL_SET_ERR_MSG(extack, "TX dma-buf SG length must be PAGE_SIZE aligned");
> +			goto err_free_chunks;
> +		}
> +
>  		owner = kzalloc_node(sizeof(*owner), GFP_KERNEL,
>  				     dev_to_node(&dev->dev));
>  		if (!owner) {
> -- 
> 2.53.0
> 

Re: [PATCH net] net: devmem: reject TX dma-buf with non-page-aligned size or SG length

[David CARLIER]

 > If the real exported already export page-aligned, why does it need
  > to go into net/stable?

  That sentence was meant as "this won't break legit callers", not
  "the OOB is unreachable" — sorry, badly phrased. The reachability
  doesn't depend on the exporter: bind accepts any dmabuf->size,
  allocates tx_vec sized size / PAGE_SIZE, and net_devmem_get_niov_at()
  indexes tx_vec[virt_addr / PAGE_SIZE] with only "virt_addr <
  dmabuf->size" as the check. size = N*PAGE_SIZE + r lets iov_base
  = N*PAGE_SIZE pass the bound check and read tx_vec[N]. dma-buf
  itself doesn't require dmabuf->size to be page-aligned; rejecting
  that layout is the bind path's job, not the exporter's. I'll rewrite
  the commit message around that.

  > why not do this check on both rx and tx?

  You're right on the SG-length check — RX runs the same
  num_niovs = len / PAGE_SIZE with gen_pool covering the full byte
  len, so a non-page-multiple non-final SG entry is malformed there
  too (no OOB, but still wrong). v2 will hoist it out of the TX
  branch. The size-multiple check stays TX-only — tx_vec is the only
  allocation sized off dmabuf->size / PAGE_SIZE.

  Also taking Bobby's nit, dropping the bool todevice.

Cheers