Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Missing memcg accounting for user-controllable SVM attribute ranges allows container memory limits bypass. --
commit f35c005d13717cede67aa4978b72564791769d8e Author: Honglei Huang <[email protected]> drm/amdgpu: implement SVM attribute tree and helper functions This commit implements the foundation for the amdgpu SVM attribute tree, including interval tree operations and slab cache management for the attribute ranges. > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_svm_attr.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_svm_attr.c > new file mode 100644 > index 0000000000000..ba09aa3c3fe4d > --- /dev/null > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_svm_attr.c [ ... ] > +int amdgpu_svm_attr_cache_init(void) > +{ > + amdgpu_svm_attr_range_cache = AMDGPU_SVM_KMEM_CACHE_CREATE( > + "amdgpu_svm_attr_range_cache", struct > amdgpu_svm_attr_range); [Severity: High] AMDGPU_SVM_KMEM_CACHE_CREATE passes 0 for flags, which omits SLAB_ACCOUNT during the creation of this cache. > + if (!amdgpu_svm_attr_range_cache) > + return -ENOMEM; > + > + return 0; > +} [ ... ] > +struct amdgpu_svm_attr_range * > +amdgpu_svm_attr_range_alloc(unsigned long start_page, > + unsigned long last_page, > + const struct amdgpu_svm_attrs *attrs) > +{ > + struct amdgpu_svm_attr_range *range; > + > + range = kmem_cache_zalloc(amdgpu_svm_attr_range_cache, GFP_KERNEL); [Severity: High] Does this code allow a container to bypass memory cgroup limits? Since the cache is created without SLAB_ACCOUNT, and the allocation here uses GFP_KERNEL without __GFP_ACCOUNT, these amdgpu_svm_attr_range objects are not charged to the caller's memcg. If userspace fragments the SVM attribute tree on a per-page basis by applying alternating attributes across a large virtual memory area, could this exhaust host kernel memory by forcing the allocation of millions of unaccounted range structures? > + if (!range) > + return NULL; > + > + INIT_LIST_HEAD(&range->list); -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
