Linaro-mm-sig June 2026

linaro-mm-sig@lists.linaro.org

95 participants
462 discussions

Rediscovering the Simple Joy of Snake Game

by semantic.rooster.guyw＠hidingmail.net

In a world filled with hyper-realistic graphics and complex narratives, there's a timeless charm to be found in the classics. One such gem that continues to captivate players, young and old, is the ubiquitous Snake Game. Its elegant simplicity belies a surprising depth of strategy and a satisfyingly addictive quality. If you've ever found yourself with a few minutes to spare, or just craving a dose of nostalgic fun, understanding how to play or experience this iconic game is a delightful journey. https://snakegame.onl The Basics: A Dance of Pixels and Precision At its core, Snake Game is wonderfully straightforward. You control a "snake" – typically a series of colored blocks – navigating a confined playing field. Your objective is to guide the snake to consume "food" (often represented as a single pixel or fruit) that appears randomly on the screen. Each time your snake eats, it grows longer. The challenge arises from this very growth; the longer your snake becomes, the more difficult it is to maneuver without hitting the boundaries of the playing area or, crucially, hitting your own ever-expanding body. Movement is typically controlled with arrow keys or a simple swipe mechanic on touchscreens. Up, down, left, and right are your only commands, but the timing and foresight with which you use them are paramount. The game progresses in a continuous loop, with your snake constantly moving forward. The moment you collide with a wall or your own tail, it's game over. Your score is usually determined by the number of food items you've consumed. Beyond the Basics: Tips for Becoming a Serpent Savant While the rules are easy to grasp, mastering Snake Game requires a bit of practice and a few strategic insights. The Art of the Open Space: Always try to keep a significant portion of the playing field open, especially in front of your snake. Don't box yourself into corners or create unavoidable dead-ends too early. Think a few moves ahead about where your tail will be. Perimeter Prowling: A common strategy is to keep your snake moving along the outer edges of the playing area. This gives you more room to react and lessens the chance of an unexpected collision with your own body. Controlled Chaos: Sometimes, the food appears in a tricky spot. Don't be afraid to make a quick, daring move to grab it, but always have an escape plan. Rapid changes in direction can be your friend, but only if executed with precision. Embrace the Challenge: As your snake grows, the game inevitably becomes more intense. Embrace this escalating difficulty! It's where the true thrill of the game lies. Don't get discouraged by early "game over" screens; each attempt refines your reflexes and strategic thinking. A Timeless Classic for Everyone Whether you remember it from early mobile phones or are discovering it for the first time on a web browser, the allure of the Snake Game remains potent. Its simple mechanics make it accessible to anyone, while its increasing difficulty offers a continuous challenge. It's a fantastic way to unwind, test your reflexes, and experience the satisfaction of a well-executed plan. So, why not give it a try? You can easily find it online, for instance, at Snake Game, and embark on your own pixelated adventure. You might just find yourself happily lost in the pursuit of the longest snake.

1 week, 3 days

[PATCH] dma-buf: move system_cc_shared heap under separate Kconfig

by Sumit Semwal

From: Arnd Bergmann <arnd(a)arndb.de> While system heap and system_cc_shared heap share a lot of code and hence the same source file, their users have different needs. system heap users need it to be a loadable module, while system_cc_shared heap users don't. Building as a loadable module breaks system_cc_shared heap on powerpc and s390 due to un-exported set_memory_encrypted / set_memory_decrypted functions. Fix these by reorganising code to put the system_cc_shared heap under a new Kconfig symbol, which allows either building both into the kernel, or leave encryption up to the consumers of the system heap. Fixes: fd55edff8a0a ("dma-buf: heaps: system: Turn the heap into a module") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Sumit Semwal <sumit.semwal(a)linaro.org> --- drivers/dma-buf/heaps/Kconfig | 8 ++++++++ drivers/dma-buf/heaps/system_heap.c | 16 ++++++++++------ 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/drivers/dma-buf/heaps/Kconfig b/drivers/dma-buf/heaps/Kconfig index e273fb18feca..a39decdcf067 100644 --- a/drivers/dma-buf/heaps/Kconfig +++ b/drivers/dma-buf/heaps/Kconfig @@ -5,6 +5,14 @@ config DMABUF_HEAPS_SYSTEM Choose this option to enable the system dmabuf heap. The system heap is backed by pages from the buddy allocator. If in doubt, say Y. +config DMABUF_HEAPS_CC_SYSTEM + bool "DMA-BUF System Heap for decrypted CoCo VMs" + depends on DMABUF_HEAPS && ARCH_HAS_MEM_ENCRYPT && DMABUF_HEAPS_SYSTEM=y + help + Choose this option to enable the system_cc_shared dmabuf heap. This + allows allocating shared (decrypted) memory for confidential computing + (CoCo) VMs. + config DMABUF_HEAPS_CMA tristate "DMA-BUF CMA Heap" depends on DMABUF_HEAPS && DMA_CMA diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c index c92bdec356fc..71d9028cc3df 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -48,6 +48,9 @@ struct dma_heap_attachment { bool cc_shared; }; +#define cc_shared_buffer(b) (IS_ENABLED(CONFIG_DMABUF_HEAPS_CC_SYSTEM) && \ + (b)->cc_shared) + #define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO) #define HIGH_ORDER_GFP (((GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN \ | __GFP_NORETRY) & ~__GFP_RECLAIM) \ @@ -161,7 +164,7 @@ static struct sg_table *system_heap_map_dma_buf(struct dma_buf_attachment *attac unsigned long attrs; int ret; - attrs = a->cc_shared ? DMA_ATTR_CC_SHARED : 0; + attrs = cc_shared_buffer(a) ? DMA_ATTR_CC_SHARED : 0; ret = dma_map_sgtable(attachment->dev, table, direction, attrs); if (ret) return ERR_PTR(ret); @@ -233,7 +236,7 @@ static int system_heap_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) int i, ret; prot = vma->vm_page_prot; - if (buffer->cc_shared) + if (cc_shared_buffer(buffer)) prot = pgprot_decrypted(prot); for_each_sgtable_sg(table, sg, i) { @@ -282,7 +285,7 @@ static void *system_heap_do_vmap(struct system_heap_buffer *buffer) } prot = PAGE_KERNEL; - if (buffer->cc_shared) + if (cc_shared_buffer(buffer)) prot = pgprot_decrypted(prot); vaddr = vmap(pages, npages, VM_MAP, prot); vfree(pages); @@ -349,7 +352,7 @@ static void system_heap_dma_buf_release(struct dma_buf *dmabuf) * Intentionally leak pages that cannot be re-encrypted * to prevent shared memory from being reused. */ - if (buffer->cc_shared && + if (cc_shared_buffer(buffer) && system_heap_set_page_encrypted(page)) continue; @@ -456,7 +459,7 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap, list_del(&page->lru); } - if (cc_shared) { + if (cc_shared_buffer(buffer)) { for_each_sgtable_sg(table, sg, i) { ret = system_heap_set_page_decrypted(sg_page(sg)); if (ret) @@ -485,7 +488,7 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap, * Intentionally leak pages that cannot be re-encrypted * to prevent shared memory from being reused. */ - if (buffer->cc_shared && + if (cc_shared_buffer(buffer) && system_heap_set_page_encrypted(p)) continue; __free_pages(p, compound_order(p)); @@ -525,6 +528,7 @@ static int __init system_heap_create(void) return PTR_ERR(sys_heap); if (IS_ENABLED(CONFIG_HIGHMEM) || + !IS_ENABLED(CONFIG_DMABUF_HEAPS_CC_SYSTEM) || !cc_platform_has(CC_ATTR_MEM_ENCRYPT)) return 0; -- 2.43.0

1 week, 3 days

Re: [PATCH v3 1/9] PCI/P2PDMA: Add CONFIG_PCI_P2PDMA_CORE

by Leon Romanovsky

On Wed, Jun 10, 2026 at 04:43:15PM +0100, Matt Evans wrote: > The P2PDMA code currently provides two features under the same > CONFIG_PCI_P2PDMA option: > > 1. Locate providers via pcim_p2pdma_provider() > 2. Manage actual P2P DMA > > Some drivers (such as vfio-pci) depend on 1, without having a hard > dependency on 2. > > A future commit expands the use of DMABUF in vfio-pci for non-P2P > scenarios, relying on pcim_p2pdma_provider() always being present. If > that depended on CONFIG_PCI_P2PDMA, it would make vfio-pci only > available if CONFIG_ZONE_DEVICE is present (e.g. 64-bit systems), even > when P2P is not needed. > > To resolve this, introduce CONFIG_PCI_P2PDMA_CORE and refactor the > basic provider functionality into a new p2pdma_core.c file. This is > available even if the CONFIG_PCI_P2PDMA feature is disabled (or > unavailable due to !CONFIG_ZONE_DEVICE). Then, drivers can enable any > additional P2P features with the original CONFIG_PCI_P2PDMA (available > when CONFIG_ZONE_DEVICE is set). > > Signed-off-by: Matt Evans <matt(a)ozlabs.org> > --- > MAINTAINERS | 2 +- > drivers/pci/Kconfig | 10 ++-- > drivers/pci/Makefile | 1 + > drivers/pci/p2pdma.c | 109 ++-------------------------------- > drivers/pci/p2pdma.h | 29 +++++++++ > drivers/pci/p2pdma_core.c | 118 +++++++++++++++++++++++++++++++++++++ > include/linux/pci-p2pdma.h | 24 ++++---- > include/linux/pci.h | 2 +- > 8 files changed, 174 insertions(+), 121 deletions(-) > create mode 100644 drivers/pci/p2pdma.h > create mode 100644 drivers/pci/p2pdma_core.c Thanks, Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com>

1 week, 4 days

[PATCH net-next 0/4] net: devmem: allow rx-buf-size > PAGE_SIZE per binding

by Bobby Eshleman

Every devmem dmabuf binding hands the page_pool PAGE_SIZE niovs today. On NICs that consume one descriptor per netmem, this caps a single RX descriptor at PAGE_SIZE and burns CPU on buffer churn. In this series, we add a bind-time netlink attribute, NETDEV_A_DMABUF_RX_BUF_SIZE, that lets userspace request a larger niov size (power of two >= PAGE_SIZE). Drivers must opt in via queue_mgmt_ops.QCFG_RX_PAGE_SIZE. Selftests use udmabuf, but udmabuf sgtables were previously hardcoded to PAGE_SIZE. This series modifies udmabuf to respect folio sizes in its exported sgtable. The result is that when backing udmabuf with MFD_HUGETLB 2MB pages, the sgtable is populated with 2MB entries, allowing devmem's gen_pool to carve out large (eg. 64K) niovs. Measurements ------------ Setup: kperf devmem RX/TX cuda, 4 flows, 64 MB messages, 60s, dctcp, num-rx-queues=4, dmabuf-rx/tx-size-mb=2048, 10 runs per niov size, mlx5. niov RX dev Gbps RX flow avg Gbps app sys % ----- ---------------- ----------------- ---------------- 4K 300.63 +/- 53.21 75.16 +/- 13.30 54.15 +/- 10.23 16K 321.35 +/- 28.20 80.34 +/- 7.05 41.05 +/- 8.87 32K 347.63 +/- 2.20 86.91 +/- 0.55 44.54 +/- 3.51 64K 332.11 +/- 14.26 83.03 +/- 3.56 35.47 +/- 3.11 RX app sys % drops ~19% from 4K to 64K. kperf support (not yet merged): https://github.com/facebookexperimental/kperf/commit/8837577f920876bce6986e… Signed-off-by: Bobby Eshleman <bobbyeshleman(a)meta.com> --- Bobby Eshleman (4): net: devmem: allow rx-buf-size > PAGE_SIZE per dmabuf binding udmabuf: emit one sg entry per pinned folio selftests/net: ncdevmem: add -b option to set rx-buf-size on bind selftests/net: devmem.py: add check_rx_large_niov Documentation/netlink/specs/netdev.yaml | 8 ++++ drivers/dma-buf/udmabuf.c | 47 ++++++++++++++++--- include/uapi/linux/netdev.h | 1 + net/core/devmem.c | 52 +++++++++++++--------- net/core/devmem.h | 13 ++++-- net/core/netdev-genl-gen.c | 5 ++- net/core/netdev-genl.c | 18 +++++++- tools/include/uapi/linux/netdev.h | 1 + tools/testing/selftests/drivers/net/hw/config | 1 + tools/testing/selftests/drivers/net/hw/devmem.py | 12 ++++- .../testing/selftests/drivers/net/hw/devmem_lib.py | 46 ++++++++++++++++++- tools/testing/selftests/drivers/net/hw/ncdevmem.c | 49 ++++++++++++++++++-- .../testing/selftests/drivers/net/hw/nk_devmem.py | 11 ++++- 13 files changed, 220 insertions(+), 44 deletions(-) --- base-commit: dfcc2ff12925d99e858eaf539eaa4aaaf81fe2a6 change-id: 20260602-tcpdm-large-niovs-56523a3a1077 Best regards, -- Bobby Eshleman <bobbyeshleman(a)meta.com>

1 week, 4 days

[PATCH v5 1/2] accel/rocket: Fix error path handling in rocket_job_run()

by ZhaoJinming

In rocket_job_run(), after taking an extra fence reference for job->done_fence via dma_fence_get(), the error paths have three bugs: - The dma_fence reference held by job->done_fence is never released, causing a reference leak. - pm_runtime_get_sync() increments the usage counter even on failure, but the error path does not decrement it, leaking the runtime PM reference and preventing the NPU from suspending. - A valid but unsignaled fence is returned to the DRM scheduler, which triggers WARN("Fence ... released with pending signals!") when the scheduler drops its reference. Fix by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get() which auto-balances the usage counter on failure, releasing both fence references on error, and returning ERR_PTR(ret) instead of the unsignaled fence. Cc: stable(a)vger.kernel.org Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Signed-off-by: ZhaoJinming <zhaojinming(a)uniontech.com> --- drivers/accel/rocket/rocket_job.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c index ac51bff39833..e8a073e22ac2 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -310,13 +310,22 @@ static struct dma_fence *rocket_job_run(struct drm_sched_job *sched_job) dma_fence_put(job->done_fence); job->done_fence = dma_fence_get(fence); - ret = pm_runtime_get_sync(core->dev); - if (ret < 0) - return fence; + ret = pm_runtime_resume_and_get(core->dev); + if (ret < 0) { + dma_fence_put(job->done_fence); + job->done_fence = NULL; + dma_fence_put(fence); + return ERR_PTR(ret); + } ret = iommu_attach_group(job->domain->domain, core->iommu_group); - if (ret < 0) - return fence; + if (ret < 0) { + pm_runtime_put(core->dev); + dma_fence_put(job->done_fence); + job->done_fence = NULL; + dma_fence_put(fence); + return ERR_PTR(ret); + } scoped_guard(mutex, &core->job_lock) { core->in_flight_job = job; -- 2.20.1

1 week, 4 days

[PATCH v4 1/2] accel/rocket: Fix error path handling in rocket_job_run()

by ZhaoJinming

1 week, 4 days

[PATCH v19 0/4] Rust bindings for gem shmem

by Lyude Paul

Most of this patch series has already been pushed upstream, this is just the second half of the patch series that has not been pushed yet + some additional changes which were required to implement changes requested by the mailing list. This patch series is originally from Asahi, previously posted by Daniel Almeida. The previous version of the patch series can be found here: https://patchwork.freedesktop.org/series/164580/ Branch with patches applied available here: https://gitlab.freedesktop.org/lyudess/linux/-/commits/rust/gem-shmem This patch series applies on top of drm-rust-next Patch-series wide changes since V15: * Fix some major rebasing errors I somehow didn't notice :( * Drop the dependency on LazyInit, use the trick that Alice suggested instead. * Fix dependency ordering so that Tyr can get the vmap stuff first without the other bits. Patch-series wide changes since V16: * Fix ordering one more time (SetOnce::reset() doesn't need to come before adding vmap functions) * Rebase against the latest DeviceContext changes from me that got pushed. Lyude Paul (4): rust: drm: gem: shmem: Add DmaResvGuard helper rust: drm: gem: shmem: Add vmap functions rust: faux: Allow retrieving a bound Device rust: drm: gem: Introduce shmem::Object::sg_table() rust/kernel/drm/gem/shmem.rs | 524 ++++++++++++++++++++++++++++++++++- rust/kernel/faux.rs | 16 +- 2 files changed, 524 insertions(+), 16 deletions(-) base-commit: fea3a2dd7d3fc1936211ced5f84420e610435730 -- 2.54.0

1 week, 4 days

MUYERN TRUST HACKER || Private Digital Security

by priyankaragade6＠gmail.com

It is 2026. Cryptocurrency is no longer just an investment; it is the backbone of a new global financial system. Millions of people now manage their wealth through digital assets like Bitcoin, Ethereum, and USDT. This shift has brought unprecedented financial freedom, but it has also opened the door to a new era of cybercrime. From sophisticated phishing attacks and fake investment platforms to direct wallet hacks, the methods used by scammers have become increasingly complex. Every day, victims lose access to their hard-earned digital assets. The feeling of helplessness is overwhelming—but it is not the end of the story. At MUYERN TRUST HACKER, we turn that helplessness into action. Recognized as the Best, Top, and Most Trusted Cryptocurrency Recovery Company in 2026, we have been fighting crypto crime since 2010. With over $990 Million recovered and a reported 99% success rate, we don’t just promise results; we deliver them. But how exactly do we recover what seems lost? Here is a look at our proven methodology. The Myth of "Untraceable" Crypto Many victims believe that once crypto is stolen, it is gone forever because blockchain is anonymous. This is a misconception. Blockchain is pseudonymous, not anonymous. Every transaction leaves a permanent, public footprint. While scammers use mixers and bridges to hide their tracks, they eventually need to cash out. That is where they make mistakes—and where we step in. Our 4-Step Recovery Process We combine cutting-edge technology with legal expertise to trace, freeze, and return your assets. 1. Forensic Case Assessment Recovery begins with intelligence. When you contact us, our experts conduct a deep-dive analysis of your case. We review transaction hashes, wallet addresses, and communication logs to identify the type of fraud (e.g., romance scam, investment fraud, or hack). We determine the viability of recovery before proceeding, ensuring transparency and honesty from day one. 2. Advanced Blockchain Tracing Using proprietary forensic tools, we trace the movement of your funds across multiple blockchains. Even if scammers attempt to launder money through decentralized exchanges (DEXs) or privacy protocols, our algorithms identify patterns and link illicit addresses to known entities. We follow the money trail until it reaches a point of vulnerability—usually a centralized exchange or a regulated financial institution. 3. Strategic Legal Intervention Tracing is only half the battle. To recover funds, we must act where the criminals cash out. We collaborate with: Global Exchanges: Providing irrefutable forensic evidence to freeze accounts holding stolen funds. Law Enforcement: Assisting cybercrime units with detailed investigation reports. Legal Networks: Navigating international jurisdictions to secure asset returns through legal channels. This multi-pronged approach puts immense pressure on bad actors and compliant platforms to return the assets. 4. Secure Asset Return & Protection Once funds are recovered, we facilitate their secure transfer back to your personal wallet. But our job doesn’t end there. We provide a post-recovery security audit, helping you strengthen your digital defenses to prevent future attacks. We believe in empowering our clients, not just rescuing them. Why MUYERN TRUST HACKER is the Leader in 2026 In an industry rife with secondary scams, trust is everything. Here is why thousands of victims choose us: Proven Longevity: Operating since 2010, we have evolved alongside the technology, giving us unmatched experience. Massive Impact: We have recovered over $990 Million in digital assets for individuals and businesses worldwide. High Success Rate: Our rigorous vetting process ensures a reported 99% Crypto Recovery Rate for accepted cases. Global Reach: Cybercrime has no borders, and neither do we. Our network spans major financial hubs across the globe. Don’t Let Scammers Win If you have lost cryptocurrency to fraud, hacks, or scams, time is critical. The faster you act, the higher the chance of recovery. You do not have to face this alone. Join the thousands of clients who have reclaimed their financial freedom with MUYERN TRUST HACKER. Ready to Start Your Recovery? Contact our specialist team today for a confidential, no-obligation case assessment. Email: [ muyerntrusted(at)mail-me(.)c o m ] What App: [ +1.2.0.2.7.0.3.2.2.3.9 ]

1 week, 4 days

[PATCH v7] dma-buf: Fix silent overflow for phys vec to sgt

by David Hu

In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len. Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`. Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `check_add_overflow()` for `nents` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match. Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Cc: stable(a)vger.kernel.org Cc: iommu(a)lists.linux.dev Reviewed-by: Pranjal Shrivastava <praan(a)google.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Reviewed-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: David Hu <xuehaohu(a)google.com> --- Changes in v7: - Added a missing blank line after local variable declaration in `calc_sg_nents()` (Leon). - Collected Reviewed-by from Leon Romanovsky. Changes in v6: - Used `check_add_overflow()` in `calc_sg_nents()` for safer accumulation (Leon). - Dropped explicit `!nents` check and added a comment noting that `sg_alloc_table` handles `nents == 0` (Leon). - Collected Reviewed-by from Kevin Tian. Changes in v5: - Removed WARN_ON_ONCE from calc_sg_nents() to avoid log noise (Jason). - Added explicit check for `!nents` in dma_buf_phys_vec_to_sgt() to cleanly return -EINVAL on overflow (Jason). Changes in v4: - Added WARN_ON_ONCE() to the nents overflow check to prevent silent failures (Claude Bot). Changes in v3: - Removed leftover sentence fragment from the commit message. - Kept `nents = 0` initialization (previously stated as removed in the v2 changelog) as it is strictly required for the `+=` accumulation loop in `calc_sg_nents()`. Changes in v2: - Fixed 'IVOA' -> 'IOVA' typo and expanded commit message (Claude Bot). - Added Reverse Xmas tree formatting (Pranjal). - Folded in extra bounds checking for calc_sg_nents() (Pranjal). - Folded in type consistency fix for fill_sg_entry() (Pranjal). - Collected Reviewed-by from Pranjal Shrivastava. drivers/dma-buf/dma-buf-mapping.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 794acff2546a..80f6ab2f4809 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -5,12 +5,13 @@ */ #include <linux/dma-buf-mapping.h> #include <linux/dma-resv.h> +#include <linux/overflow.h> static struct scatterlist *fill_sg_entry(struct scatterlist *sgl, size_t length, dma_addr_t addr) { unsigned int len, nents; - int i; + unsigned int i; nents = DIV_ROUND_UP(length, UINT_MAX); for (i = 0; i < nents; i++) { @@ -40,8 +41,12 @@ static unsigned int calc_sg_nents(struct dma_iova_state *state, size_t i; if (!state || !dma_use_iova(state)) { - for (i = 0; i < nr_ranges; i++) - nents += DIV_ROUND_UP(phys_vec[i].len, UINT_MAX); + for (i = 0; i < nr_ranges; i++) { + unsigned int added = DIV_ROUND_UP(phys_vec[i].len, UINT_MAX); + + if (check_add_overflow(nents, added, &nents)) + return 0; + } } else { /* * In IOVA case, there is only one SG entry which spans @@ -95,9 +100,10 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, size_t nr_ranges, size_t size, enum dma_data_direction dir) { - unsigned int nents, mapped_len = 0; struct dma_buf_dma *dma; struct scatterlist *sgl; + size_t mapped_len = 0; + unsigned int nents; dma_addr_t addr; size_t i; int ret; @@ -133,6 +139,8 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, } nents = calc_sg_nents(dma->state, phys_vec, nr_ranges, size); + + /* sg_alloc_table will cleanly fail and return -EINVAL if nents == 0 */ ret = sg_alloc_table(&dma->sgt, nents, GFP_KERNEL | __GFP_ZERO); if (ret) goto err_free_state; -- 2.54.0.1064.gd145956f57-goog

1 week, 5 days

[PATCH v6] dma-buf: Fix silent overflow for phys vec to sgt

by David Hu

In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len. Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`. Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `check_add_overflow()` for `nents` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match. Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Cc: stable(a)vger.kernel.org Cc: iommu(a)lists.linux.dev Reviewed-by: Pranjal Shrivastava <praan(a)google.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Signed-off-by: David Hu <xuehaohu(a)google.com> --- Changes in v6: - Used `check_add_overflow()` in `calc_sg_nents()` for safer accumulation (Leon). - Dropped explicit `!nents` check and added a comment noting that `sg_alloc_table` handles `nents == 0` (Leon). - Collected Reviewed-by from Kevin Tian. Changes in v5: - Removed WARN_ON_ONCE from calc_sg_nents() to avoid log noise (Jason). - Added explicit check for `!nents` in dma_buf_phys_vec_to_sgt() to cleanly return -EINVAL on overflow (Jason). Changes in v4: - Added WARN_ON_ONCE() to the nents overflow check to prevent silent failures (Claude Bot). Changes in v3: - Removed leftover sentence fragment from the commit message. - Kept `nents = 0` initialization (previously stated as removed in the v2 changelog) as it is strictly required for the `+=` accumulation loop in `calc_sg_nents()`. Changes in v2: - Fixed 'IVOA' -> 'IOVA' typo and expanded commit message (Claude Bot). - Added Reverse Xmas tree formatting (Pranjal). - Folded in extra bounds checking for calc_sg_nents() (Pranjal). - Folded in type consistency fix for fill_sg_entry() (Pranjal). - Collected Reviewed-by from Pranjal Shrivastava. drivers/dma-buf/dma-buf-mapping.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 794acff2546a..67a8ff52fb8f 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -5,12 +5,13 @@ */ #include <linux/dma-buf-mapping.h> #include <linux/dma-resv.h> +#include <linux/overflow.h> static struct scatterlist *fill_sg_entry(struct scatterlist *sgl, size_t length, dma_addr_t addr) { unsigned int len, nents; - int i; + unsigned int i; nents = DIV_ROUND_UP(length, UINT_MAX); for (i = 0; i < nents; i++) { @@ -40,8 +41,11 @@ static unsigned int calc_sg_nents(struct dma_iova_state *state, size_t i; if (!state || !dma_use_iova(state)) { - for (i = 0; i < nr_ranges; i++) - nents += DIV_ROUND_UP(phys_vec[i].len, UINT_MAX); + for (i = 0; i < nr_ranges; i++) { + unsigned int added = DIV_ROUND_UP(phys_vec[i].len, UINT_MAX); + if (check_add_overflow(nents, added, &nents)) + return 0; + } } else { /* * In IOVA case, there is only one SG entry which spans @@ -95,9 +99,10 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, size_t nr_ranges, size_t size, enum dma_data_direction dir) { - unsigned int nents, mapped_len = 0; struct dma_buf_dma *dma; struct scatterlist *sgl; + size_t mapped_len = 0; + unsigned int nents; dma_addr_t addr; size_t i; int ret; @@ -133,6 +138,8 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, } nents = calc_sg_nents(dma->state, phys_vec, nr_ranges, size); + + /* sg_alloc_table will cleanly fail and return -EINVAL if nents == 0 */ ret = sg_alloc_table(&dma->sgt, nents, GFP_KERNEL | __GFP_ZERO); if (ret) goto err_free_state; -- 2.54.0.1064.gd145956f57-goog

1 week, 5 days

← Newer
1
...
40
41
42
43
44
45
46
47
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig June 2026