Re: [PATCH net] net: devmem: reject TX dma-buf with non-page-aligned size or SG length

[David CARLIER]

 > If the real exported already export page-aligned, why does it need
  > to go into net/stable?

  That sentence was meant as "this won't break legit callers", not
  "the OOB is unreachable" — sorry, badly phrased. The reachability
  doesn't depend on the exporter: bind accepts any dmabuf->size,
  allocates tx_vec sized size / PAGE_SIZE, and net_devmem_get_niov_at()
  indexes tx_vec[virt_addr / PAGE_SIZE] with only "virt_addr <
  dmabuf->size" as the check. size = N*PAGE_SIZE + r lets iov_base
  = N*PAGE_SIZE pass the bound check and read tx_vec[N]. dma-buf
  itself doesn't require dmabuf->size to be page-aligned; rejecting
  that layout is the bind path's job, not the exporter's. I'll rewrite
  the commit message around that.

  > why not do this check on both rx and tx?

  You're right on the SG-length check — RX runs the same
  num_niovs = len / PAGE_SIZE with gen_pool covering the full byte
  len, so a non-page-multiple non-final SG entry is malformed there
  too (no OOB, but still wrong). v2 will hoist it out of the TX
  branch. The size-multiple check stays TX-only — tx_vec is the only
  allocation sized off dmabuf->size / PAGE_SIZE.

  Also taking Bobby's nit, dropping the bool todevice.

Cheers