From: Tao Cui <[email protected]> IOMMUFD_CMD_HW_QUEUE_ALLOC pins up to max_npages pages just to check that a user supplied queue region is physically contiguous, and the page array for that check is plain GFP_KERNEL. The size comes from cmd->length, a u64 that is only overflow checked, and the array is freed again as soon as the contiguity check fails, so the allocation can be repeated concurrently: a 1GB region costs about 2MB of uncharged memory per attempt.
Every other iommufd allocation that scales with user input is already charged, and the pinned pages charge the mapper at map time. Charge this array like the rest. Signed-off-by: Tao Cui <[email protected]> --- drivers/iommu/iommufd/viommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/viommu.c b/drivers/iommu/iommufd/viommu.c index f7951057a1e5..ab17e190da49 100644 --- a/drivers/iommu/iommufd/viommu.c +++ b/drivers/iommu/iommufd/viommu.c @@ -330,7 +330,8 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd, * Use kvcalloc() to avoid memory fragmentation for a large page array. * Set __GFP_NOWARN to avoid syzkaller blowups */ - pages = kvzalloc_objs(*pages, max_npages, GFP_KERNEL | __GFP_NOWARN); + pages = kvzalloc_objs(*pages, max_npages, + GFP_KERNEL | __GFP_NOWARN | __GFP_ACCOUNT); if (!pages) return ERR_PTR(-ENOMEM); -- 2.43.0
