Re: [PATCH] dma-buf/udmabuf: reinstate a reasonable default size limit

[Christian König]

On 9/22/26 03:23, Jiakai Xu wrote:
> Commit 44e9eb5a7621 ("dma-buf/udmabuf: Disable the size limit by
> default") raised the default size_limit_mb from 64 to INT_MAX.
> 
> With 4 KiB pages on a 64-bit system, creating a buffer larger than
> about 1 TiB makes the two per-page pointer arrays in init_udmabuf()
> exceed what kvmalloc() can handle.  __kvmalloc_node_noprof() warns and
> fails when the requested size exceeds INT_MAX bytes, which is
> trivially triggerable by unprivileged users through the UDMABUF_CREATE
> ioctls:
> 
>   WARNING: CPU: 0 PID: 412 at mm/slub.c:7021 __kvmalloc_node_noprof
>   Call Trace:
>    udmabuf_create
>    udmabuf_ioctl_create_list
> 
> Instead of using a fixed megabyte value, derive the default limit from
> the kvmalloc() threshold:
> 
>   (((INT_MAX / sizeof(struct folio *)) - 1) >> 20) << PAGE_SHIFT
> 
> On a 64-bit system with 4 KiB pages, this evaluates to 1044480 MB
> (1020 GiB), allowing buffers a little below 1 TiB while keeping the
> per-page pointer array allocations below INT_MAX bytes.
> 
> Fixes: 44e9eb5a7621 ("dma-buf/udmabuf: Disable the size limit by default")
> Suggested-by: Christian König <christian.koenig@xxxxxxx>
> Assisted-by: OpenCode:DeepSeek-V4-Flash
> Signed-off-by: Jiakai Xu <xujiakai24@xxxxxxxxxxxxxxxx>

Reviewed-by: Christian König <christian.koenig@xxxxxxx>

Going to push that to drm-misc-fixes later today.

Regards,
Christian.

> ---
> V2 -> V3:
> - Replace the fixed 256 MB default with a limit derived from the
>   kvmalloc() INT_MAX threshold, as suggested by Christian König.  On
>   64-bit systems with 4 KiB pages, this allows buffers just below
>   1 TiB.
> 
> V1 -> V2:
> - Instead of adding a pgcnt check in udmabuf_create(), restore a
>   reasonable default size limit (256 MB), as suggested by Christian
>   König.
> - Drop the second Fixes tag; the regression is solely due to
>   44e9eb5a7621.
> - Drop the "Cc: stable" tag; 44e9eb5a7621 is only in v7.3-rc1 and has
>   not shipped in any released kernel yet.
> 
> V1: https://lore.kernel.org/all/20260918013434.1849135-1-xujiakai24@xxxxxxxxxxxxxxxx/
> V2: https://lore.kernel.org/all/20260919015731.2077604-1-xujiakai24@xxxxxxxxxxxxxxxx/
> ---
>  drivers/dma-buf/udmabuf.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
> index df6dd00462423..7ec269809fb49 100644
> --- a/drivers/dma-buf/udmabuf.c
> +++ b/drivers/dma-buf/udmabuf.c
> @@ -20,9 +20,10 @@ static int list_limit = 1024;
>  module_param(list_limit, int, 0644);
>  MODULE_PARM_DESC(list_limit, "udmabuf_create_list->count limit. Default is 1024.");
>  
> -static int size_limit_mb = INT_MAX;
> +static int size_limit_mb = (((INT_MAX / sizeof(struct folio *)) - 1) >> 20) << PAGE_SHIFT;
>  module_param(size_limit_mb, int, 0644);
> -MODULE_PARM_DESC(size_limit_mb, "Max size of a dmabuf, in megabytes. Default is INT_MAX.");
> +MODULE_PARM_DESC(size_limit_mb,
> +		 "Max size of a dmabuf, in megabytes. Default is derived from the kvmalloc() limit.");
>  
>  struct udmabuf {
>  	pgoff_t pagecount;