Re: [PATCH] dma: swiotlb: Round restricted DMA pool size down to IO_TLB_SEGSIZE

[Marek Szyprowski]

On 03.11.2026 16:50, Marek Szyprowski wrote:
> All other paths creating a swiotlb pool ensure that nslabs is a multiple
> of IO_TLB_SEGSIZE, and the swiotlb code relies on that. Since commit
> 0b84e4f8b793 ("swiotlb: Add restricted DMA pool initialization") a
> restricted pool can have an arbitrary size taken from the device tree.
>
> If the pool size is not a multiple of IO_TLB_SEGSIZE, the last segment is
> partial and swiotlb_release_slots() reads mem->slots[index + nslabs],
> which is one past the end of the slots array when the freed buffer ends
> at the end of the pool:
>
>  BUG: KASAN: slab-out-of-bounds in swiotlb_release_slots
>  Read of size 2
>
> Round the pool size down to a multiple of IO_TLB_SEGSIZE, wasting a bit
> of memory, and warn about it.
>
> Reported-by: Giorgi Kobakhia <gkobakhi@xxxxxxx>
> Closes: https://lore.kernel.org/all/20261026032007.1957949-1-gkobakhi@xxxxxxx/
> Fixes: 0b84e4f8b793 ("swiotlb: Add restricted DMA pool initialization")
> CC: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>

Applied to dma-mapping-fixes.


> ---
>  kernel/dma/swiotlb.c | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
>
>
Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland