On 6/27/2024 4:43 PM, Dmitry Baryshkov wrote:
> On Thu, Jun 27, 2024 at 11:35:18AM GMT, Ekansh Gupta wrote:
>> For user PD initialization, initmem is allocated and sent to DSP for
>> initial memory requirements like shell loading. This size is passed
>> by user space and is checked against a max size. For unsigned PD
>> offloading, more than 2MB size could be passed by user which would
>> result in PD initialization failure. Remove the user PD initmem size
>> check and allow buffer allocation for user passed size. Any additional
>> memory sent to DSP during PD init is used as the PD heap.
> Would it allow malicious userspace to allocate big enough buffers and
> reduce the amount of memory available to the system? To other DSP
> programs?
The allocation here is happening from SMMU context bank which is uniquely assigned
to processes going to DSP. As per my understanding process can allocate maximum
4GB of memory from the context bank and the memory availability will be taken care
by kernel memory management. Please correct me if my understanding is incorrect.
--Ekansh
>> Fixes: 7f1f481263c3 ("misc: fastrpc: check before loading process to the DSP")
>> Cc: stable <stable@xxxxxxxxxx>
>> Signed-off-by: Ekansh Gupta <quic_ekangupt@xxxxxxxxxxx>
>> ---
>> Changes in v2:
>> - Modified commit text.
>> - Removed size check instead of updating max file size.
>>
>> drivers/misc/fastrpc.c | 5 -----
>> 1 file changed, 5 deletions(-)
>>
>> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
>> index 5204fda51da3..9d064deeac89 100644
>> --- a/drivers/misc/fastrpc.c
>> +++ b/drivers/misc/fastrpc.c
>> @@ -1389,11 +1389,6 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
>> goto err;
>> }
>>
>> - if (init.filelen > INIT_FILELEN_MAX) {
>> - err = -EINVAL;
>> - goto err;
>> - }
>> -
>> inbuf.pgid = fl->tgid;
>> inbuf.namelen = strlen(current->comm) + 1;
>> inbuf.filelen = init.filelen;
>> --
>> 2.34.1
>>
