Patch "swiotlb: reduce the number of areas to match actual memory pool size" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    swiotlb: reduce the number of areas to match actual memory pool size

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b5a318236c968f18cbf207f75a11fd89ed54b05f
Author: Petr Tesarik <petr.tesarik.ext@xxxxxxxxxx>
Date:   Mon Jun 26 15:01:04 2023 +0200

    swiotlb: reduce the number of areas to match actual memory pool size
    
    [ Upstream commit 8ac04063354a01a484d2e55d20ed1958aa0d3392 ]
    
    Although the desired size of the SWIOTLB memory pool is increased in
    swiotlb_adjust_nareas() to match the number of areas, the actual allocation
    may be smaller, which may require reducing the number of areas.
    
    For example, Xen uses swiotlb_init_late(), which in turn uses the page
    allocator. On x86, page size is 4 KiB and MAX_ORDER is 10 (1024 pages),
    resulting in a maximum memory pool size of 4 MiB. This corresponds to 2048
    slots of 2 KiB each. The minimum area size is 128 (IO_TLB_SEGSIZE),
    allowing at most 2048 / 128 = 16 areas.
    
    If num_possible_cpus() is greater than the maximum number of areas, areas
    are smaller than IO_TLB_SEGSIZE and contiguous groups of free slots will
    span multiple areas. When allocating and freeing slots, only one area will
    be properly locked, causing race conditions on the unlocked slots and
    ultimately data corruption, kernel hangs and crashes.
    
    Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock")
    Signed-off-by: Petr Tesarik <petr.tesarik.ext@xxxxxxxxxx>
    Reviewed-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
    Signed-off-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index cc0c55ed20429..491d3c86c2280 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -140,6 +140,23 @@ static void swiotlb_adjust_nareas(unsigned int nareas)
 			(default_nslabs << IO_TLB_SHIFT) >> 20);
 }
 
+/**
+ * limit_nareas() - get the maximum number of areas for a given memory pool size
+ * @nareas:	Desired number of areas.
+ * @nslots:	Total number of slots in the memory pool.
+ *
+ * Limit the number of areas to the maximum possible number of areas in
+ * a memory pool of the given size.
+ *
+ * Return: Maximum possible number of areas.
+ */
+static unsigned int limit_nareas(unsigned int nareas, unsigned long nslots)
+{
+	if (nslots < nareas * IO_TLB_SEGSIZE)
+		return nslots / IO_TLB_SEGSIZE;
+	return nareas;
+}
+
 static int __init
 setup_io_tlb_npages(char *str)
 {
@@ -347,6 +364,7 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
 {
 	struct io_tlb_mem *mem = &io_tlb_default_mem;
 	unsigned long nslabs;
+	unsigned int nareas;
 	size_t alloc_size;
 	void *tlb;
 
@@ -359,10 +377,12 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
 		swiotlb_adjust_nareas(num_possible_cpus());
 
 	nslabs = default_nslabs;
+	nareas = limit_nareas(default_nareas, nslabs);
 	while ((tlb = swiotlb_memblock_alloc(nslabs, flags, remap)) == NULL) {
 		if (nslabs <= IO_TLB_MIN_SLABS)
 			return;
 		nslabs = ALIGN(nslabs >> 1, IO_TLB_SEGSIZE);
+		nareas = limit_nareas(nareas, nslabs);
 	}
 
 	if (default_nslabs != nslabs) {
@@ -408,6 +428,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
 {
 	struct io_tlb_mem *mem = &io_tlb_default_mem;
 	unsigned long nslabs = ALIGN(size >> IO_TLB_SHIFT, IO_TLB_SEGSIZE);
+	unsigned int nareas;
 	unsigned char *vstart = NULL;
 	unsigned int order, area_order;
 	bool retried = false;
@@ -453,8 +474,8 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
 			(PAGE_SIZE << order) >> 20);
 	}
 
-	area_order = get_order(array_size(sizeof(*mem->areas),
-		default_nareas));
+	nareas = limit_nareas(default_nareas, nslabs);
+	area_order = get_order(array_size(sizeof(*mem->areas), nareas));
 	mem->areas = (struct io_tlb_area *)
 		__get_free_pages(GFP_KERNEL | __GFP_ZERO, area_order);
 	if (!mem->areas)
@@ -468,7 +489,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
 	set_memory_decrypted((unsigned long)vstart,
 			     (nslabs << IO_TLB_SHIFT) >> PAGE_SHIFT);
 	swiotlb_init_io_tlb_mem(mem, virt_to_phys(vstart), nslabs, 0, true,
-				default_nareas);
+				nareas);
 
 	swiotlb_print_info();
 	return 0;