summaryrefslogtreecommitdiffstats
path: root/drivers/dma-buf
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2018-09-11 15:42:10 +0200
committerGerd Hoffmann <kraxel@redhat.com>2018-09-12 08:21:30 +0200
commitdc4716d75154b36cb115d2a1871655ed0f2e10b2 (patch)
tree08e9f359c5a529671e46b3405b3651475b8ce261 /drivers/dma-buf
parentudmabuf: add MEMFD_CREATE dependency (diff)
downloadlinux-dc4716d75154b36cb115d2a1871655ed0f2e10b2.tar.xz
linux-dc4716d75154b36cb115d2a1871655ed0f2e10b2.zip
udmabuf: rework limits
Create variable for the list length limit. Serves as documentation, also allows to make it a module parameter if needed. Also add a total size limit. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-8-kraxel@redhat.com
Diffstat (limited to 'drivers/dma-buf')
-rw-r--r--drivers/dma-buf/udmabuf.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 51cc585faab9..e32c381eca7d 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -12,6 +12,9 @@
#include <linux/slab.h>
#include <linux/udmabuf.h>
+static const u32 list_limit = 1024; /* udmabuf_create_list->count limit */
+static const size_t size_limit_mb = 64; /* total dmabuf size, in megabytes */
+
struct udmabuf {
pgoff_t pagecount;
struct page **pages;
@@ -123,7 +126,7 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
struct file *memfd = NULL;
struct udmabuf *ubuf;
struct dma_buf *buf;
- pgoff_t pgoff, pgcnt, pgidx, pgbuf;
+ pgoff_t pgoff, pgcnt, pgidx, pgbuf, pglimit;
struct page *page;
int seals, ret = -EINVAL;
u32 i, flags;
@@ -132,12 +135,15 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
if (!ubuf)
return -ENOMEM;
+ pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
for (i = 0; i < head->count; i++) {
if (!IS_ALIGNED(list[i].offset, PAGE_SIZE))
goto err_free_ubuf;
if (!IS_ALIGNED(list[i].size, PAGE_SIZE))
goto err_free_ubuf;
ubuf->pagecount += list[i].size >> PAGE_SHIFT;
+ if (ubuf->pagecount > pglimit)
+ goto err_free_ubuf;
}
ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(struct page *),
GFP_KERNEL);
@@ -227,7 +233,7 @@ static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
return -EFAULT;
- if (head.count > 1024)
+ if (head.count > list_limit)
return -EINVAL;
lsize = sizeof(struct udmabuf_create_item) * head.count;
list = memdup_user((void __user *)(arg + sizeof(head)), lsize);