Re: [PATCH 1/1] swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC

[Halil Pasic]

On Wed,  8 Nov 2023 12:12:49 +0100
Petr Tesarik <petrtesarik@xxxxxxxxxxxxxxx> wrote:

> From: Petr Tesarik <petr.tesarik1@xxxxxxxxxxxxxxxxxxx>
> 
> Limit the free list length to the size of the IO TLB. Transient pool can be
> smaller than IO_TLB_SEGSIZE, but the free list is initialized with the
> assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE.
> As a result, swiotlb_area_find_slots() may allocate slots past the end of
> a transient IO TLB buffer.
> 
> Reported-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
> Closes: https://lore.kernel.org/linux-iommu/104a8c8fedffd1ff8a2890983e2ec1c26bff6810.camel@xxxxxxxxxxxxx/
> Fixes: 79636caad361 ("swiotlb: if swiotlb is full, fall back to a transient memory pool")
> Cc: Halil Pasic <pasic@xxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Petr Tesarik <petr.tesarik1@xxxxxxxxxxxxxxxxxxx>

Reviewed-by: Halil Pasic <pasic@xxxxxxxxxxxxx>

I believe there is at least one stale comment in the code that says
"The number of slot in an area should be a multiple of IO_TLB_SEGSIZE"
but that is probably not stable material, so I do agree with keeping this
patch minimal.

Regards,
Halil