On 9/22/26 03:23, Jiakai Xu wrote:
Commit 44e9eb5a7621 ("dma-buf/udmabuf: Disable the size limit by default") raised the default size_limit_mb from 64 to INT_MAX.
With 4 KiB pages on a 64-bit system, creating a buffer larger than about 1 TiB makes the two per-page pointer arrays in init_udmabuf() exceed what kvmalloc() can handle. __kvmalloc_node_noprof() warns and fails when the requested size exceeds INT_MAX bytes, which is trivially triggerable by unprivileged users through the UDMABUF_CREATE ioctls:
WARNING: CPU: 0 PID: 412 at mm/slub.c:7021 __kvmalloc_node_noprof Call Trace: udmabuf_create udmabuf_ioctl_create_list
Instead of using a fixed megabyte value, derive the default limit from the kvmalloc() threshold:
(((INT_MAX / sizeof(struct folio *)) - 1) >> 20) << PAGE_SHIFT
On a 64-bit system with 4 KiB pages, this evaluates to 1044480 MB (1020 GiB), allowing buffers a little below 1 TiB while keeping the per-page pointer array allocations below INT_MAX bytes.
Fixes: 44e9eb5a7621 ("dma-buf/udmabuf: Disable the size limit by default") Suggested-by: Christian König christian.koenig@amd.com Assisted-by: OpenCode:DeepSeek-V4-Flash Signed-off-by: Jiakai Xu xujiakai24@mails.ucas.ac.cn
Reviewed-by: Christian König christian.koenig@amd.com
Going to push that to drm-misc-fixes later today.
Regards, Christian.
V2 -> V3:
- Replace the fixed 256 MB default with a limit derived from the kvmalloc() INT_MAX threshold, as suggested by Christian König. On 64-bit systems with 4 KiB pages, this allows buffers just below 1 TiB.
V1 -> V2:
- Instead of adding a pgcnt check in udmabuf_create(), restore a reasonable default size limit (256 MB), as suggested by Christian König.
- Drop the second Fixes tag; the regression is solely due to 44e9eb5a7621.
- Drop the "Cc: stable" tag; 44e9eb5a7621 is only in v7.3-rc1 and has not shipped in any released kernel yet.
V1: https://lore.kernel.org/all/20260918013434.1849135-1-xujiakai24@mails.ucas.a... V2: https://lore.kernel.org/all/20260919015731.2077604-1-xujiakai24@mails.ucas.a...
drivers/dma-buf/udmabuf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index df6dd00462423..7ec269809fb49 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -20,9 +20,10 @@ static int list_limit = 1024; module_param(list_limit, int, 0644); MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. Default is 1024."); -static int size_limit_mb = INT_MAX; +static int size_limit_mb = (((INT_MAX / sizeof(struct folio *)) - 1) >> 20) << PAGE_SHIFT; module_param(size_limit_mb, int, 0644); -MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in megabytes. Default is INT_MAX."); +MODULE_PARM_DESC(size_limit_mb,
"Max size of a dmabuf, in megabytes. Default is derived from the kvmalloc() limit.");struct udmabuf { pgoff_t pagecount;