Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

22 participants
7040 discussions

[PATCH] dma-buf: udmabuf: validate create-list count before copying

by Samuel Moelius

UDMABUF_CREATE_LIST copies a variable-length list using a byte count derived from head.count. The list_limit module parameter is signed and writable, so setting it negative lets a large unsigned count bypass the limit check. The u32 byte-count calculation can then wrap, causing only a small list to be copied while udmabuf_create() still iterates over the large count. Reject negative list_limit values and use checked size_t multiplication before copying the list. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius <sam.moelius(a)trailofbits.com> --- drivers/dma-buf/udmabuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index 94b8ecb892bb..46b077639bfb 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -13,6 +13,7 @@ #include <linux/hugetlb.h> #include <linux/slab.h> #include <linux/udmabuf.h> +#include <linux/overflow.h> #include <linux/vmalloc.h> #include <linux/iosys-map.h> @@ -489,13 +490,14 @@ static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg) struct udmabuf_create_list head; struct udmabuf_create_item *list; int ret = -EINVAL; - u32 lsize; + size_t lsize; if (copy_from_user(&head, (void __user *)arg, sizeof(head))) return -EFAULT; - if (head.count > list_limit) + if (list_limit < 0 || head.count > list_limit) + return -EINVAL; + if (check_mul_overflow(sizeof(struct udmabuf_create_item), head.count, &lsize)) return -EINVAL; - lsize = sizeof(struct udmabuf_create_item) * head.count; list = memdup_user((void __user *)(arg + sizeof(head)), lsize); if (IS_ERR(list)) return PTR_ERR(list); -- 2.43.0

2 months, 2 weeks

[PATCH v17 0/6] Rust bindings for gem shmem

by Lyude Paul

Most of this patch series has already been pushed upstream, this is just the second half of the patch series that has not been pushed yet + some additional changes which were required to implement changes requested by the mailing list. This patch series is originally from Asahi, previously posted by Daniel Almeida. The previous version of the patch series can be found here: https://patchwork.freedesktop.org/series/164580/ Branch with patches applied available here: https://gitlab.freedesktop.org/lyudess/linux/-/commits/rust/gem-shmem This patch series applies on top of drm-rust-next Patch-series wide changes since V15: * Fix some major rebasing errors I somehow didn't notice :( * Drop the dependency on LazyInit, use the trick that Alice suggested instead. * Fix dependency ordering so that Tyr can get the vmap stuff first without the other bits. Patch-series wide changes since V16: * Fix ordering one more time (SetOnce::reset() doesn't need to come before adding vmap functions) * Rebase against the latest DeviceContext changes from me that got pushed. Lyude Paul (6): rust: drm: gem: shmem: Fix Default implementation for ObjectConfig rust: drm: gem: shmem: Add DmaResvGuard helper rust: drm: gem: shmem: Add vmap functions rust: faux: Allow retrieving a bound Device rust: sync: Add SetOnce::reset() rust: drm: gem: Introduce shmem::Object::sg_table() rust/kernel/drm/gem/shmem.rs | 518 ++++++++++++++++++++++++++++++++++- rust/kernel/faux.rs | 7 +- rust/kernel/sync/set_once.rs | 60 +++- 3 files changed, 563 insertions(+), 22 deletions(-) base-commit: 723bd79ca9e492cc91850094a2892bde0345c51a -- 2.54.0

2 months, 2 weeks

A Wild Crossing Adventure in Crossy Road

by huffmansamuel908＠gmail.com

Crossy Road is the kind of game that looks cute and simple… until you realize you’ve been playing for an hour straight. All you do is cross roads, rivers, and train tracks while trying not to get hit or fall behind. Sounds easy, right? Not really. The longer you survive, the faster and crazier everything becomes. The pixel graphics, funny characters, and random chaos make every run feel different. One second you’re doing great, the next second a train appears out of nowhere. Crossy Road proves that a simple game can still be super fun, addictive, and impossible to put down. https://crossyroad-game.io

2 months, 2 weeks

Slope Rider 3D: Drift Through Snowy Danger

by huffmansamuel908＠gmail.com

Slope Rider 3D is a captivating endless runner arcade game that delivers non-stop excitement through its dynamic 3D environment and ever-increasing speed. With its sleek design and smooth gameplay flow, the game creates a highly engaging experience where every moment feels intense and unpredictable. The minimalist concept combined with rapid progression makes it perfect for players looking for quick entertainment or a long, immersive challenge. https://sloperider3d.io

2 months, 2 weeks

[PATCH RESEND v2] dma-buf: heaps: use max3 in dma_heap_ioctl

by Thorsten Blum

Replace two nested max() calls with a single max3() in dma_heap_ioctl(). Reviewed-by: T.J. Mercier <tjmercier(a)google.com> Signed-off-by: Thorsten Blum <thorsten.blum(a)linux.dev> --- Changes in v2: - Include minmax.h as suggested by T.J. Mercier - v1: https://lore.kernel.org/lkml/20260427172519.417333-3-thorsten.blum@linux.de… --- drivers/dma-buf/dma-heap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c index ac5f8685a649..d49188893608 100644 --- a/drivers/dma-buf/dma-heap.c +++ b/drivers/dma-buf/dma-heap.c @@ -13,6 +13,7 @@ #include <linux/err.h> #include <linux/export.h> #include <linux/list.h> +#include <linux/minmax.h> #include <linux/nospec.h> #include <linux/syscalls.h> #include <linux/uaccess.h> @@ -153,7 +154,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd, in_size = 0; if ((ucmd & kcmd & IOC_OUT) == 0) out_size = 0; - ksize = max(max(in_size, out_size), drv_size); + ksize = max3(in_size, out_size, drv_size); /* If necessary, allocate buffer for ioctl argument */ if (ksize > sizeof(stack_kdata)) {

2 months, 2 weeks

[PATCH v5] dma-buf: Fix silent overflow for phys vec to sgt

by David Hu

In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len. Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`. Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `size_t` for `nents` and checking against `UINT_MAX` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match. Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Cc: stable(a)vger.kernel.org Cc: iommu(a)lists.linux.dev Reviewed-by: Pranjal Shrivastava <praan(a)google.com> Signed-off-by: David Hu <xuehaohu(a)google.com> --- Changes in v5: - Removed WARN_ON_ONCE from calc_sg_nents() to avoid log noise (Jason). - Added explicit check for `!nents` in dma_buf_phys_vec_to_sgt() to cleanly return -EINVAL on overflow (Jason). Changes in v4: - Added WARN_ON_ONCE() to the nents overflow check to prevent silent failures (Claude Bot). Changes in v3: - Removed leftover sentence fragment from the commit message. - Kept `nents = 0` initialization (previously stated as removed in the v2 changelog) as it is strictly required for the `+=` accumulation loop in `calc_sg_nents()`. Changes in v2: - Fixed 'IVOA' -> 'IOVA' typo and expanded commit message (Claude Bot). - Added Reverse Xmas tree formatting (Pranjal). - Folded in extra bounds checking for calc_sg_nents() (Pranjal). - Folded in type consistency fix for fill_sg_entry() (Pranjal). drivers/dma-buf/dma-buf-mapping.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 794acff2546a..607b7998463d 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -10,7 +10,7 @@ static struct scatterlist *fill_sg_entry(struct scatterlist *sgl, size_t length, dma_addr_t addr) { unsigned int len, nents; - int i; + unsigned int i; nents = DIV_ROUND_UP(length, UINT_MAX); for (i = 0; i < nents; i++) { @@ -36,7 +36,7 @@ static unsigned int calc_sg_nents(struct dma_iova_state *state, struct phys_vec *phys_vec, size_t nr_ranges, size_t size) { - unsigned int nents = 0; + size_t nents = 0; size_t i; if (!state || !dma_use_iova(state)) { @@ -51,6 +51,9 @@ static unsigned int calc_sg_nents(struct dma_iova_state *state, nents = DIV_ROUND_UP(size, UINT_MAX); } + if (nents > UINT_MAX) + return 0; + return nents; } @@ -95,9 +98,10 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, size_t nr_ranges, size_t size, enum dma_data_direction dir) { - unsigned int nents, mapped_len = 0; struct dma_buf_dma *dma; struct scatterlist *sgl; + size_t mapped_len = 0; + unsigned int nents; dma_addr_t addr; size_t i; int ret; @@ -133,6 +137,11 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, } nents = calc_sg_nents(dma->state, phys_vec, nr_ranges, size); + if (!nents) { + ret = -EINVAL; + goto err_free_state; + } + ret = sg_alloc_table(&dma->sgt, nents, GFP_KERNEL | __GFP_ZERO); if (ret) goto err_free_state; -- 2.54.0.929.g9b7fa37559-goog

2 months, 2 weeks

Jumping to the Beat

by huffmansamuel908＠gmail.com

With its fast tempo and unforgiving obstacles, Geometry Dash Lite offers a unique challenge that keeps players fully engaged. The game uses simple tap controls, yet demands sharp focus and perfect timing to survive each level. Bright colors, sharp shapes, and energetic music combine to create an intense atmosphere. As players retry levels again and again, they slowly improve their skills and reaction speed. https://geometrylite2.io

2 months, 2 weeks

[PATCH v16 0/6] Rust bindings for gem shmem

by Lyude Paul

Most of this patch series has already been pushed upstream, this is just the second half of the patch series that has not been pushed yet + some additional changes which were required to implement changes requested by the mailing list. This patch series is originally from Asahi, previously posted by Daniel Almeida. The previous version of the patch series can be found here: https://patchwork.freedesktop.org/series/164580/ Branch with patches applied available here: https://gitlab.freedesktop.org/lyudess/linux/-/commits/rust/gem-shmem This patch series applies on top of drm-rust-next Patch-series wide changes since V15: * Fix some major rebasing errors I somehow didn't notice :( * Drop the dependency on LazyInit, use the trick that Alice suggested instead. * Fix dependency ordering so that Tyr can get the vmap stuff first without the other bits. Lyude Paul (6): rust: drm: gem/shmem: Add DmaResvGuard helper rust: drm: gem: Add vmap functions to shmem bindings rust: sync: Add SetOnce::reset() rust: gem: shmem: Fix Default implementation for ObjectConfig rust: faux: Allow retrieving a bound Device rust: drm: gem: Introduce shmem::Object::sg_table() rust/kernel/drm/gem/shmem.rs | 507 ++++++++++++++++++++++++++++++++++- rust/kernel/faux.rs | 7 +- rust/kernel/sync/set_once.rs | 60 ++++- 3 files changed, 552 insertions(+), 22 deletions(-) base-commit: b78dab829760aee9b83f5cf15550a0fe36c6f4b0 -- 2.54.0

2 months, 2 weeks

Slither into Fun: Mastering the Art of the Adorable Serpent

by joelburke＠wshu.net

Remember the joy of classic arcade games? The simple yet addictive thrill of guiding a character through a challenging environment, aiming for the top score? In the vast ocean of online games, one title consistently delivers that nostalgic punch with a modern twist: Slither io. This seemingly straightforward game, where you control a growing snake, offers an engaging and surprisingly strategic experience that can captivate players for hours. If you're looking for a delightful way to pass the time or a new challenge to conquer, let's dive into the charming world of Slither io. The Hypnotic Dance of Growth: Understanding Slither io Gameplay At its core, Slither io is an incredibly easy game to pick up. You start as a small, unassuming snake, slithering across a vast arena filled with colorful, glowing dots. Your primary objective? To eat these dots and grow. Each dot consumed adds a tiny segment to your snake, making you longer and, consequently, more imposing. https://slitherio.onl The catch, and where the real fun begins, lies in the other snakes. The arena is teeming with fellow players, each trying to grow their own serpentine champion. Your snake's head is its Achilles' heel. If your head collides with any part of another snake’s body, it's game over. You burst into a cloud of those precious glowing dots, which then become a feast for your rivals. Conversely, if another snake’s head collides with your body, they explode, leaving their accumulated mass for you to gobble up. This creates a thrilling dynamic of predator and prey, where even the smallest snake can take down the largest with a well-timed maneuver. Movement is equally intuitive. You control your snake's direction with your mouse or finger (on mobile). A subtle but crucial mechanic is "boosting." By holding down the left mouse button (or tapping and holding on mobile), your snake speeds up, leaving a trail of its own mass behind. This boost is invaluable for quick escapes, aggressive maneuvers, or snatching up desirable food before a competitor. However, be warned: boosting constantly will cause your snake to shrink, as you sacrifice your hard-earned length for speed. Mastering the art of when and how to boost is a key element of success. Weaving Your Way to Victory: Essential Tips and Strategies While the basic gameplay is simple, becoming a top-tier Slither io player requires a blend of observation, strategy, and a little bit of nerve. Here are some tips to help you dominate the arena: Patience is a Virtue: Don't rush into every cluster of food or chase every small snake. Focus on steady growth initially. Stay near the edges of the map where there's usually less competition and more scattered dots. The Art of the Encirclement: One of the most satisfying ways to take down a larger opponent is to encircle them. Once you're big enough, coil around a smaller snake, slowly tightening your grip until they have nowhere to go but into your body. This takes practice and a good sense of timing. Boost Wisely, Not Wildly: Boosting is a powerful tool, but use it strategically. It's excellent for darting in to steal food from under another snake's nose, making a quick escape from a dangerous situation, or closing in on a vulnerable opponent. Avoid continuous boosting, as it shrinks you rapidly. The "Head-on" Gambit: Sometimes, a risky head-on approach can pay off. If you're confident in your agility, you can try to cut in front of another snake's path, forcing them to collide with your body. This is a high-risk, high-reward strategy. Learn from the Fallen: When a large snake explodes, it leaves a significant amount of food. This is often the prime target for many players, leading to chaotic scrambles. Don't be afraid to dive into these situations, but be extremely careful. Approach the food from the outside, picking off segments rather than rushing directly into the center. Observe and Anticipate: Pay attention to the movements of other snakes. Are they aggressive? Are they fleeing? Anticipating their next move can give you a crucial advantage in both offense and defense. Master the Corner Turn: When you’re long, turning sharply can be tricky. Practice making smooth, wide turns to avoid accidental collisions with your own body or other snakes. Conversely, a quick, tight turn can sometimes trap an unsuspecting smaller snake. The Endless Appeal of the Serpent's Saga Slither io isn't just about winning; it's about the journey. The thrill of outmaneuvering a colossal snake, the satisfaction of seeing your own grow to an impressive length, and the continuous challenge of navigating a bustling arena make for a truly engaging experience. The game's vibrant colors, smooth animations, and surprisingly competitive gameplay combine to create an addictive and enjoyable pastime. Whether you're a seasoned gamer or just looking for a simple yet captivating diversion, take a chance on this modern classic. You might just find yourself happily slithering for hours on end, aiming to become the longest and most fearsome serpent in the arena. Experience the fun yourself at Slither io and embark on your own journey to the top of the leaderboard!

2 months, 2 weeks

Re: Unleash Your Inner Ninja: A Guide to Slicing Success in Slice Master

by mariacharles0911＠gmail.com

Experience the excitement of Geometry Dash https://geometry-online.io, a thrilling platformer that combines music, speed, and precision. Race through dazzling neon environments, avoid dangerous geometric obstacles, and synchronize your movements with the rhythm. Every level offers a fresh challenge that will push your reflexes and timing to their limits.

2 months, 2 weeks

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig