Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] mm: memcontrol: 32-bit nr_pages truncation in dmabuf charge helpers --

commit a5e6165b3e0444a33f57a14736c2174d7c009944 Author: T.J. Mercier tjmercier@google.com

memcg: Add MEMCG_DMABUF accounting infrastructure

This commit introduces the MEMCG_DMABUF stat counter and helper functions to reserve, cancel, and uncharge dma-buf memory against a memory cgroup, tracking the active charge via a memcg pointer on struct dma_buf.

diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 856a7d07586cc..e53dd7eebc3b5 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c

[ ... ]

@@ -5658,6 +5661,73 @@ void mem_cgroup_flush_workqueue(void) flush_workqueue(memcg_wq); } +/**

• • mem_cgroup_reserve_dmabuf - charge a memcg for a dma-buf allocation
• • @memcg: memcg to charge (may be %NULL)
• • @gfp_mask: reclaim mode
• • @nr_pages: number of pages to charge
• • Charges @nr_pages against @memcg. Call this before allocating pages so
• • the cgroup limit is enforced up front. On success the caller must
• • finalize the charge with the MEMCG_DMABUF stat update, or call
• • mem_cgroup_cancel_dmabuf() to undo it.
• • Returns %true on success, %false if the charge would exceed the limit.
• */

+bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp_mask,

• 	       unsigned int nr_pages)
  

+{

• if (!memcg || mem_cgroup_disabled())

• return true;
  

• if (try_charge(memcg, gfp_mask, nr_pages))

• return false;
  

• return true;

+} +EXPORT_SYMBOL_GPL(mem_cgroup_reserve_dmabuf);

+/**

• • mem_cgroup_cancel_dmabuf - undo a dma-buf charge
• • @memcg: memcg to uncharge (may be %NULL)
• • @nr_pages: same value passed to mem_cgroup_reserve_dmabuf()
• • Returns @nr_pages of charge to @memcg. Use when the allocation fails
• • after mem_cgroup_reserve_dmabuf().
• */

+void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, unsigned int nr_pages) +{

• if (!memcg)

• return;
  

• if (!mem_cgroup_is_root(memcg))

• refill_stock(memcg, nr_pages);
  

+} +EXPORT_SYMBOL_GPL(mem_cgroup_cancel_dmabuf);

+/**

• • mem_cgroup_uncharge_dmabuf - uncharge a dma-buf from its memcg
• • @dmabuf: buffer to uncharge
• • Reverses a finalized dma-buf charge. Drops the memcg
• • reference stored in @dmabuf->memcg and clears the pointer.
• • Safe to call when @dmabuf->memcg is %NULL.
• */

+void mem_cgroup_uncharge_dmabuf(struct dma_buf *dmabuf) +{

• unsigned int nr_pages;
• struct mem_cgroup *memcg = dmabuf->memcg;
• if (!memcg)

• return;
  

• nr_pages = PAGE_ALIGN(dmabuf->size) >> PAGE_SHIFT;
• mod_memcg_state(memcg, MEMCG_DMABUF, -nr_pages);
• mem_cgroup_cancel_dmabuf(memcg, nr_pages);
• mem_cgroup_put(memcg);
• dmabuf->memcg = NULL;

+}

[Severity: Medium] Can passing a 32-bit unsigned int for nr_pages in mem_cgroup_reserve_dmabuf(), mem_cgroup_cancel_dmabuf(), and mem_cgroup_uncharge_dmabuf() in mm/memcontrol.c (and include/linux/memcontrol.h) truncate 64-bit dma-buf sizes?

struct dma_buf stores size as a 64-bit size_t, and in the following commit ("dma-heap: charge dma-buf memory via explicit memcg"), dma_heap_ioctl_allocate() -> system_heap_allocate() passes a 64-bit PAGE_ALIGN(len) >> PAGE_SHIFT to mem_cgroup_reserve_dmabuf() before entering its while (size_remaining > 0) page allocation loop without __GFP_ACCOUNT.

If a userspace caller requests an allocation where len >= (1ULL << (32 + PAGE_SHIFT)) (for example, (1ULL << 44) + PAGE_SIZE on a 4 KiB page system), PAGE_ALIGN(len) >> PAGE_SHIFT wraps to 1 page when converted to unsigned int nr_pages. try_charge() will then succeed against a small memory.max limit while system_heap_allocate() proceeds to allocate unaccounted pages using the full 64-bit size_remaining.

Additionally, in mem_cgroup_uncharge_dmabuf(), passing -nr_pages to mod_memcg_state(memcg, MEMCG_DMABUF, -nr_pages) (which takes a signed int val) will overflow when nr_pages exceeds INT_MAX. Should nr_pages use unsigned long (or size_t) across these helpers?

On Thu, Nov 12, 2026 at 08:26:35AM +0100, Thomas Hellström wrote:

On Wed, 2026-11-04 at 12:09 +0100, Albert Esteve wrote:

...

From: "T.J. Mercier" tjmercier@google.com

Introduce a MEMCG_DMABUF stat counter and helpers for charging, cancelling, and uncharging dma-buf memory against a memory cgroup.

The charge is tracked on struct dma_buf via a new memcg pointer. The memcg reference is stored into (or cleared from) dmabuf->memcg by the helpers, removing the need for callers to manage those details. The release path in dma_buf_release() is reduced to a single mem_cgroup_uncharge_dmabuf() call.

Rather than charging at the page level via __GFP_ACCOUNT, which would require exporters to expose their backing pages for cross-cgroup transfer via new dma_buf_ops, charges are tracked externally on struct dma_buf through a single accounting path.

The next patch wires up the charging policy in the dma-heap ioctl.

Signed-off-by: T.J. Mercier tjmercier@google.com Signed-off-by: Albert Esteve aesteve@redhat.com

---

Documentation/admin-guide/cgroup-v2.rst |  4 ++  drivers/dma-buf/dma-buf.c               |  3 ++  include/linux/dma-buf.h                 |  4 ++  include/linux/memcontrol.h              | 27 +++++++++++++  mm/memcontrol.c                         | 70 +++++++++++++++++++++++++++++++++  5 files changed, 108 insertions(+)

diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst index 86a2a0099178..a3265a4a953e 100644 --- a/Documentation/admin-guide/cgroup-v2.rst +++ b/Documentation/admin-guide/cgroup-v2.rst @@ -1662,6 +1662,10 @@ The following nested keys are defined.   Amount of memory used for storing in-kernel data   structures.

• dmabuf (npn)

• Amount of memory used for exported DMA buffers
  

allocated by the cgroup.

• Stays with the allocating cgroup regardless of how
  

the buffer is shared.

workingset_refault_anon   Number of refaults of previously evicted anonymous pages.   diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 4c9add51f9ef..1c6b9cee7ac2 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -14,6 +14,7 @@  #include <linux/fs.h>  #include <linux/slab.h>  #include <linux/dma-buf.h> +#include <linux/memcontrol.h>  #include <linux/dma-fence.h>  #include <linux/dma-fence-unwrap.h>  #include <linux/anon_inodes.h> @@ -182,6 +183,8 @@ static void dma_buf_release(struct dentry *dentry)     dmabuf->ops->release(dmabuf);

• mem_cgroup_uncharge_dmabuf(dmabuf);

if (dmabuf->resv == (struct dma_resv *)&dmabuf[1])   dma_resv_fini(dmabuf->resv);   diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index d15b2b31d3c9..23ec0ff23fba 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -27,6 +27,7 @@  struct device;  struct dma_buf;  struct dma_buf_attachment; +struct mem_cgroup;    /**   * struct dma_buf_ops - operations possible on struct dma_buf @@ -429,6 +430,9 @@ struct dma_buf {     __poll_t active;   } cb_in, cb_out;

• /** @memcg: the cgroup to which this buffer is currently

attributed */

• struct mem_cgroup *memcg;

};    /** diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 7d1c0ce189a8..4d1e82cf0833 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -10,6 +10,9 @@    #ifndef _LINUX_MEMCONTROL_H  #define _LINUX_MEMCONTROL_H

+struct dma_buf;

#include <linux/cgroup.h>  #include <linux/vm_event_item.h>  #include <linux/hardirq.h> @@ -40,6 +43,7 @@ enum memcg_stat_item {   MEMCG_ZSWAP_B,   MEMCG_ZSWAPPED,   MEMCG_ZSWAP_INCOMP,

• MEMCG_DMABUF,

MEMCG_NR_STAT,  };   @@ -667,6 +671,9 @@ int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp);  int mem_cgroup_swapin_charge_folio(struct folio *folio, unsigned short id,      struct mm_struct *mm, gfp_t gfp);   +bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp,

• 	       unsigned int nr_pages);
  

void __mem_cgroup_uncharge(struct folio *folio);    /** @@ -682,6 +689,10 @@ static inline void mem_cgroup_uncharge(struct folio *folio)   __mem_cgroup_uncharge(folio);  }   +void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, unsigned int nr_pages);

+void mem_cgroup_uncharge_dmabuf(struct dma_buf *dmabuf);

void __mem_cgroup_uncharge_folios(struct folio_batch *folios);  static inline void mem_cgroup_uncharge_folios(struct folio_batch *folios)  { @@ -1167,10 +1178,26 @@ static inline int mem_cgroup_swapin_charge_folio(struct folio *folio,   return 0;  }   +static inline bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg,

• 			     gfp_t gfp,
  

• 			     unsigned int nr_pages)
  

+{

• return true;

+}

+static inline void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg,

• 			    unsigned int nr_pages)
  

+{ +}

static inline void mem_cgroup_uncharge(struct folio *folio)  {  }   +static inline void mem_cgroup_uncharge_dmabuf(struct dma_buf *dmabuf) +{ +}

static inline void mem_cgroup_uncharge_folios(struct folio_batch *folios)  {  } diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 856a7d07586c..e53dd7eebc3b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -69,6 +69,7 @@  #include <net/ip.h>  #include "slab.h"  #include "memcontrol-v1.h" +#include <linux/dma-buf.h>    #include <linux/uaccess.h>   @@ -442,6 +443,7 @@ static const unsigned int memcg_stat_items[] = {   MEMCG_ZSWAP_B,   MEMCG_ZSWAPPED,   MEMCG_ZSWAP_INCOMP,

• MEMCG_DMABUF,

};    #define NR_MEMCG_NODE_STAT_ITEMS ARRAY_SIZE(memcg_node_stat_items) @@ -1625,6 +1627,7 @@ static const struct memory_stat memory_stats[] = {  #ifdef CONFIG_HUGETLB_PAGE   { "hugetlb", NR_HUGETLB },  #endif

• {

"dmabuf", MEMCG_DMABUF },     /* The memory events */   { "workingset_refault_anon", WORKINGSET_REFAULT_ANON }, @@ -5658,6 +5661,73 @@ void mem_cgroup_flush_workqueue(void)   flush_workqueue(memcg_wq);  }   +/**

• • mem_cgroup_reserve_dmabuf - charge a memcg for a dma-buf

allocation

• • @memcg: memcg to charge (may be %NULL)
• • @gfp_mask: reclaim mode
• • @nr_pages: number of pages to charge
• • Charges @nr_pages against @memcg. Call this before allocating

pages so

• • the cgroup limit is enforced up front. On success the caller must
• • finalize the charge with the MEMCG_DMABUF stat update, or call
• • mem_cgroup_cancel_dmabuf() to undo it.
• • Returns %true on success, %false if the charge would exceed the

limit.

• */

+bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp_mask,

• 	       unsigned int nr_pages)
  

+{

• if (!memcg || mem_cgroup_disabled())

• return true;
  

• if (try_charge(memcg, gfp_mask, nr_pages))

• return false;
  

• return true;

+} +EXPORT_SYMBOL_GPL(mem_cgroup_reserve_dmabuf);

+/**

• • mem_cgroup_cancel_dmabuf - undo a dma-buf charge
• • @memcg: memcg to uncharge (may be %NULL)
• • @nr_pages: same value passed to mem_cgroup_reserve_dmabuf()
• • Returns @nr_pages of charge to @memcg. Use when the allocation

fails

• • after mem_cgroup_reserve_dmabuf().
• */

+void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, unsigned int nr_pages) +{

• if (!memcg)

• return;
  

• if (!mem_cgroup_is_root(memcg))

• refill_stock(memcg, nr_pages);
  

+} +EXPORT_SYMBOL_GPL(mem_cgroup_cancel_dmabuf);

+/**

• • mem_cgroup_uncharge_dmabuf - uncharge a dma-buf from its memcg
• • @dmabuf: buffer to uncharge
• • Reverses a finalized dma-buf charge. Drops the memcg
• • reference stored in @dmabuf->memcg and clears the pointer.
• • Safe to call when @dmabuf->memcg is %NULL.
• */

+void mem_cgroup_uncharge_dmabuf(struct dma_buf *dmabuf) +{

• unsigned int nr_pages;
• struct mem_cgroup *memcg = dmabuf->memcg;
• if (!memcg)

• return;
  

• nr_pages = PAGE_ALIGN(dmabuf->size) >> PAGE_SHIFT;
• mod_memcg_state(memcg, MEMCG_DMABUF, -nr_pages);
• mem_cgroup_cancel_dmabuf(memcg, nr_pages);
• mem_cgroup_put(memcg);
• dmabuf->memcg = NULL;

+}

Instead of keeping a reference on the memcg for the buffer's whole lifetime, shouldn't an obj_cgroup be used, which is reparented when the memcg goes offline?

Good point. I did not think of it, but after a brief check I think it'd be the right object to use. I'll switch for the next version.

Like in Dave's series here:

https://lore.kernel.org/all/20260706052330.1110909-1-airlied@gmail.com/

Thanks for the link! I'll use it as reference. I should mention it in the cover letter too probably, as that series is related (should be safe as far as it does not opt-in for dma-buf-level charging).

BR, Albert

Thanks, Thomas

...

static int __init cgroup_memory(char *s)  {   char *token;

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [Critical] mm: memcontrol: missing permission checks in mem_cgroup_get_from_fd() - [High] dma-buf: system_heap: 32-bit nr_pages truncation in system_heap_allocate() --

commit e390a33c5307a75778a81c2ca5beff0530617904 Author: Albert Esteve aesteve@redhat.com

dma-heap: charge dma-buf memory via explicit memcg

This commit adds a charge_fd field to struct dma_heap_allocation_data so that DMA_HEAP_IOCTL_ALLOC can resolve a target pidfd or cgroupfd and charge the exported dma-buf memory to that memcg via mem_cgroup_reserve_dmabuf(). It also removes __GFP_ACCOUNT from system heap page allocations to avoid double counting.

diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c index c8959eadc71d1..2bd245e1eab8f 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c

[ ... ]

@@ -388,8 +389,6 @@ static struct page *alloc_largest_available(unsigned long size, if (max_order < orders[i]) continue; flags = order_flags[i];

• if (mem_accounting)
  

• 	flags |= __GFP_ACCOUNT;
  

  page = alloc_pages(flags, orders[i]); if (!page) continue;

@@ -401,11 +400,13 @@ static struct page *alloc_largest_available(unsigned long size, static struct dma_buf *system_heap_allocate(struct dma_heap *heap, unsigned long len, u32 fd_flags,

• 			    u64 heap_flags)
  

• 			    u64 heap_flags,
  

• 			    struct mem_cgroup *memcg)
  

{ struct system_heap_buffer *buffer; DEFINE_DMA_BUF_EXPORT_INFO(exp_info); unsigned long size_remaining = len;

• unsigned int nr_pages = PAGE_ALIGN(len) >> PAGE_SHIFT; unsigned int max_order = orders[0]; struct system_heap_priv *priv = dma_heap_get_drvdata(heap); bool cc_shared = priv->cc_shared;

@@ -416,10 +417,15 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap, struct page *page, *tmp_page; int i, ret = -ENOMEM;

• buffer = kzalloc_obj(*buffer);
• if (!buffer)

• if (!mem_cgroup_reserve_dmabuf(memcg, GFP_KERNEL, nr_pages)) return ERR_PTR(-ENOMEM);

[Severity: High] As reported by Sashiko on v3 [1], can truncating nr_pages to a 32-bit unsigned int in system_heap_allocate() allow a 64-bit allocation length to bypass memcg memory.max limits?

In dma_heap_ioctl_allocate(), heap_allocation->len (__u64) is page-aligned into a 64-bit size_t len and only checked for wrap-around to zero before being passed as an unsigned long len to system_heap_allocate():

drivers/dma-buf/dma-heap.c:dma_heap_ioctl_allocate() { len = PAGE_ALIGN(heap_allocation->len); if (!len) { mem_cgroup_put(memcg); return ERR_PTR(-EINVAL); }

dmabuf = heap->ops->allocate(heap, len, heap_allocation->fd_flags, heap_allocation->heap_flags, memcg); }

In system_heap_allocate(), size_remaining retains the full 64-bit len while nr_pages is truncated to unsigned int. Because __GFP_ACCOUNT is removed from alloc_largest_available(), mem_cgroup_reserve_dmabuf() becomes the only memcg limit check.

On a 64-bit system with 4 KiB pages (PAGE_SHIFT == 12), if a user passes len = (1ULL << 44) (or (1ULL << 44) + PAGE_SIZE), PAGE_ALIGN(len) >> PAGE_SHIFT truncates in 32-bit unsigned int nr_pages to 0 (or 1). mem_cgroup_reserve_dmabuf() then charges 0 (or 1) pages and succeeds inside a restricted cgroup, while the while (size_remaining > 0) loop allocates uncharged physical pages for the full 64-bit size_remaining until host RAM is exhausted and the global OOM killer is triggered.

Similarly, in dma_buf_export() and mem_cgroup_uncharge_dmabuf(), PAGE_ALIGN(size) >> PAGE_SHIFT is stored in an unsigned int nr_pages and passed to mod_memcg_state(), which takes a signed int val and can overflow to a negative delta when bit 31 of nr_pages is set. Should nr_pages be unsigned long (or should len be bounds-checked before converting to page counts)?

[ ... ]

diff --git a/mm/memcontrol.c b/mm/memcontrol.c index e53dd7eebc3b5..17fdefc56b97f 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5661,6 +5661,53 @@ void mem_cgroup_flush_workqueue(void) flush_workqueue(memcg_wq); } +/**

• • mem_cgroup_get_from_fd - resolve a memcg from a cgroupfd or pidfd
• • @fd: file descriptor (cgroupfd or pidfd)
• • Tries @fd as a cgroupfd first; if that fails, tries it as a pidfd.
• • On success returns a referenced memcg pointer. On failure returns
• • an ERR_PTR.
• */

+struct mem_cgroup *mem_cgroup_get_from_fd(int fd) +{

• struct cgroup_subsys_state *css;
• struct mem_cgroup *memcg;
• struct cgroup *cgrp;
• struct task_struct *task;
• struct mm_struct *mm;
• unsigned int pidfd_flags;
• cgrp = cgroup_get_from_fd(fd);
• if (!IS_ERR(cgrp)) {

• rcu_read_lock();
  

• css = cgroup_css(cgrp, &memory_cgrp_subsys);
  

• if (!css || !css_tryget_online(css)) {
  

• 	rcu_read_unlock();
  

• 	cgroup_put(cgrp);
  

• 	return ERR_PTR(-ENOENT);
  

• }
  

• memcg = mem_cgroup_from_css(css);
  

• rcu_read_unlock();
  

• cgroup_put(cgrp);
  

• return memcg;
  

• }
• task = pidfd_get_task(fd, &pidfd_flags);
• if (IS_ERR(task))

• return ERR_CAST(task);
  

• mm = get_task_mm(task);
• put_task_struct(task);
• if (!mm)

• return ERR_PTR(-ESRCH);
  

• memcg = get_mem_cgroup_from_mm(mm);
• mmput(mm);
• return memcg ?: ERR_PTR(-ENOENT);

+}

[Severity: Critical] As reported by Sashiko on v3 [2], does mem_cgroup_get_from_fd() allow an unprivileged caller to charge dma-buf allocations to arbitrary cgroups without permission checks?

When dma_heap_ioctl_allocate() calls mem_cgroup_get_from_fd() with a user-supplied charge_fd, the target mem_cgroup is resolved either from a cgroup v2 directory fd (which can be opened with O_RDONLY | O_DIRECTORY or O_PATH on any world-readable /sys/fs/cgroup directory, including the root cgroup) or from a pidfd obtained via pidfd_open() for any visible process such as PID 1.

Neither path verifies DAC permissions, cgroup write access (such as cgroup_may_write() or cgroup_attach_permissions() used by CLONE_INTO_CGROUP in cgroup_css_set_fork()), ptrace_may_access(), or capabilities such as CAP_SYS_ADMIN / CAP_SYS_RESOURCE.

When system_heap_allocate() then calls mem_cgroup_reserve_dmabuf(memcg, GFP_KERNEL, nr_pages) -> try_charge(), targeting root_mem_cgroup returns 0 immediately and bypasses the caller's memory.max and memory.high limits, while targeting another cgroup can trigger reclaim and OOM kills in that victim cgroup. In addition, when a remote target memcg exceeds memory.high during try_charge_memcg(), the over-high penalty and reclaim in __mem_cgroup_handle_over_high() are applied against current->mm's memcg rather than the remotely charged memcg.

Later commits in the series ("security: dma-buf: Add dma_buf_charge_task LSM hook", "security: dma-buf: Add dma_buf_charge_cgroup LSM hook", "selinux: Restrict cross-cgroup dma-buf charging", and "selinux: Restrict dma-buf direct cgroup charging") add LSM hooks and SELinux policy checks, but still leave no baseline DAC, capability, cgroup write permission, or ptrace_may_access() checks when CONFIG_SECURITY is disabled, when SELinux is not the active LSM, or when a cgroup v2 directory uses default genfscon labeling without an explicit security.selinux kernfs xattr (where selinux_dma_buf_charge_cgroup() sees kernfs_xattr_get() == -ENODATA and returns 0).

Should baseline permission checks be enforced before allowing a process to charge memory to another task's or cgroup's memcg?

[1] https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-2-78d... [2] https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-2-78d...

On Thu, Nov 12, 2026 at 08:42:18AM +0100, Thomas Hellström wrote:

On Wed, 2026-11-04 at 12:09 +0100, Albert Esteve wrote:

...

On embedded platforms a central process often allocates dma-buf memory on behalf of client applications. Without a way to attribute the charge to the requesting client's cgroup, the cost lands on the allocator, making per-cgroup memory limits ineffective for the actual consumers.

Add charge_fd to struct dma_heap_allocation_data. When set to a valid pidfd or cgroupfd, DMA_HEAP_IOCTL_ALLOC resolves the target task's or cgroup's memcg and charges the buffer there via mem_cgroup_reserve_dmabuf() inside dma_heap_ioctl_allocate(). The resolved memcg is passed through dma_buf_export_info so that dma_buf_export() stores it and updates the MEMCG_DMABUF stat. Without charge_fd, and with the mem_accounting module parameter enabled, the buffer is charged to the allocator's own cgroup. The __GPF_ACCOUNT flag is removed from system heap allocations to avoid double counting.

Usage examples:

1. Central allocator charging to a client at allocation time.      The allocator knows the client's PID (e.g., from binder's      sender_pid) and uses pidfd to attribute the charge:

pid_t client_pid = txn->sender_pid;        int pidfd = pidfd_open(client_pid, 0);

struct dma_heap_allocation_data alloc = {            .len         = buffer_size,            .fd_flags    = O_RDWR | O_CLOEXEC,            .charge_fd   = pidfd,        };        ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, &alloc);        close(pidfd);        /* alloc.fd is now charged to client's cgroup */

2. Default allocation (no pidfd, mem_accounting=1).      When charge_fd is not set and the mem_accounting module      parameter is enabled, the buffer is charged to the allocator's      own cgroup:

struct dma_heap_allocation_data alloc = {            .len      = buffer_size,            .fd_flags = O_RDWR | O_CLOEXEC,        };        ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, &alloc);        /* charged to current process's cgroup */

Current limitations:

- Single-owner model: a dma-buf carries one memcg charge regardless of    how many processes share it. Means only the first owner (and exporter)    of the shared buffer bears the charge.  - Only memcg accounting supported. While this makes sense for system    heap buffers, other heaps (e.g., CMA heaps) will require selectively    charging also for the dmem controller.

Signed-off-by: Albert Esteve aesteve@redhat.com

Documentation/admin-guide/cgroup-v2.rst |  5 ++--  drivers/dma-buf/dma-buf.c               |  5 ++++  drivers/dma-buf/dma-heap.c              | 28 +++++++++++++++++---  drivers/dma-buf/heaps/cma_heap.c        |  3 ++-  drivers/dma-buf/heaps/system_heap.c     | 21 +++++++++++----  drivers/tee/tee_heap.c                  |  3 ++-  include/linux/dma-buf.h                 |  4 +++  include/linux/dma-heap.h                |  3 ++-  include/linux/memcontrol.h              |  7 +++++  include/uapi/linux/dma-heap.h           |  7 +++++  mm/memcontrol.c                         | 47 +++++++++++++++++++++++++++++++++  11 files changed, 120 insertions(+), 13 deletions(-)

diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst index a3265a4a953e..66ddba678784 100644 --- a/Documentation/admin-guide/cgroup-v2.rst +++ b/Documentation/admin-guide/cgroup-v2.rst @@ -1663,8 +1663,9 @@ The following nested keys are defined.   structures.       dmabuf (npn)

• Amount of memory used for exported DMA buffers
  

allocated by the cgroup.

• Stays with the allocating cgroup regardless of how
  

the buffer is shared.

• Amount of memory used for exported DMA buffers
  

allocated by or on

• behalf of the cgroup. Stays with the allocating
  

cgroup regardless

• of how the buffer is shared.
  

This doesn't sound right. Graphics buffers exported as DMA buffers are typically charged elsewhere, like gpu_active, and a transfer of their charge would likely stay in that key? To be consistent, shouldn't this be related to dma-heap memory and called dmaheap or something similar.

Although this work initially targeted dma heaps only, in its current form is meant to stay generic (while solving the central allocator problem). The memory exported as dma-bufs has no memory.stat of its own, and an exporter allocating plain pages (e.g., V4L2) has nowhere else to report it.

We should have a tighter definition of exactly what memory is to be registered here.

Yes, I will be more specific and clearly state that an exporter whose memory is already accounted must not opt in. That also naturally disallows transfers.

Also says "Stays with the allocating cgroup regardless of how the buffer is shared", which isn't correct after the series? Perhaps that's changed in a later patch.

I missed updating the text after having added XFER_CHARGE to the series. I'll fix the wording in this patch and mention the transfer in the next one.

BR, Albert

Thanks, Thomas

...

workingset_refault_anon   Number of refaults of previously evicted anonymous pages. diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 1c6b9cee7ac2..837666273550 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -714,6 +714,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)   struct dma_resv *resv = exp_info->resv;   struct file *file;   size_t alloc_size = sizeof(struct dma_buf);

• unsigned int nr_pages = PAGE_ALIGN(exp_info->size) >>

PAGE_SHIFT;   int ret;     if (WARN_ON(!exp_info->priv || !exp_info->ops @@ -750,6 +751,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)   dmabuf->size = exp_info->size;   dmabuf->exp_name = exp_info->exp_name;   dmabuf->owner = exp_info->owner;

• dmabuf->memcg = exp_info->memcg;

spin_lock_init(&dmabuf->name_lock);   init_waitqueue_head(&dmabuf->poll);   dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf->poll; @@ -771,6 +773,9 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)     DMA_BUF_TRACE(trace_dma_buf_export, dmabuf);

• if (dmabuf->memcg)

• mod_memcg_state(dmabuf->memcg, MEMCG_DMABUF,
  

nr_pages);

return dmabuf;    err_file: diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c index 8a6c2b6e0cc6..7bd416ae2c23 100644 --- a/drivers/dma-buf/dma-heap.c +++ b/drivers/dma-buf/dma-heap.c @@ -10,6 +10,8 @@  #include <linux/device.h>  #include <linux/dma-buf.h>  #include <linux/dma-heap.h> +#include <linux/memcontrol.h> +#include <linux/sched/mm.h>  #include <linux/err.h>  #include <linux/export.h>  #include <linux/list.h> @@ -78,6 +80,7 @@ static struct dma_buf *dma_heap_ioctl_allocate(struct file *file, void *data)   struct dma_heap_allocation_data *heap_allocation = data;   struct dma_heap *heap = file->private_data;   struct dma_buf *dmabuf;

• struct mem_cgroup *memcg = NULL;

int fd;   size_t len;   @@ -90,15 +93,34 @@ static struct dma_buf *dma_heap_ioctl_allocate(struct file *file, void *data)   if (heap_allocation->heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS)   return ERR_PTR(-EINVAL);

• if (heap_allocation->__padding != 0)

• return ERR_PTR(-EINVAL);
  

• if (heap_allocation->charge_fd) {

• memcg = mem_cgroup_get_from_fd(heap_allocation-
  

...

charge_fd);

• if (IS_ERR(memcg))
  

• 	return ERR_CAST(memcg);
  

• }
• if (!memcg && mem_accounting)

• memcg = get_mem_cgroup_from_mm(current->mm);
  

len = PAGE_ALIGN(heap_allocation->len);

• if (!len)

• if (!len) {

• mem_cgroup_put(memcg);
  

return ERR_PTR(-EINVAL);

• }

dmabuf = heap->ops->allocate(heap, len, heap_allocation-

...

fd_flags,

• 		     heap_allocation->heap_flags);
  

• 		     heap_allocation->heap_flags,
  

memcg);

• if (IS_ERR(dmabuf))

• if (IS_ERR(dmabuf)) {

• mem_cgroup_put(memcg);
  

return dmabuf;

• }
• if (memcg && !dmabuf->memcg)

• mem_cgroup_put(memcg);
  

fd = get_unused_fd_flags(heap_allocation->fd_flags);   if (fd < 0) { diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma- buf/heaps/cma_heap.c index 3fb4b946c91a..04de88b468a8 100644 --- a/drivers/dma-buf/heaps/cma_heap.c +++ b/drivers/dma-buf/heaps/cma_heap.c @@ -281,7 +281,8 @@ static const struct dma_buf_ops cma_heap_buf_ops = {  static struct dma_buf *cma_heap_allocate(struct dma_heap *heap,   unsigned long len,   u32 fd_flags,

• 			 u64 heap_flags)
  

• 			 u64 heap_flags,
  

• 			 struct mem_cgroup *memcg)
  

{   struct cma_heap *cma_heap = dma_heap_get_drvdata(heap);   struct cma_heap_buffer *buffer; diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma- buf/heaps/system_heap.c index c8959eadc71d..2bd245e1eab8 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -17,6 +17,7 @@  #include <linux/err.h>  #include <linux/highmem.h>  #include <linux/mem_encrypt.h> +#include <linux/memcontrol.h>  #include <linux/mm.h>  #include <linux/set_memory.h>  #include <linux/module.h> @@ -388,8 +389,6 @@ static struct page *alloc_largest_available(unsigned long size,   if (max_order < orders[i])   continue;   flags = order_flags[i];

• if (mem_accounting)
  

• 	flags |= __GFP_ACCOUNT;
  

page = alloc_pages(flags, orders[i]);   if (!page)   continue; @@ -401,11 +400,13 @@ static struct page *alloc_largest_available(unsigned long size,  static struct dma_buf *system_heap_allocate(struct dma_heap *heap,       unsigned long len,       u32 fd_flags,

• 			    u64 heap_flags)
  

• 			    u64 heap_flags,
  

• 			    struct mem_cgroup
  

*memcg)  {   struct system_heap_buffer *buffer;   DEFINE_DMA_BUF_EXPORT_INFO(exp_info);   unsigned long size_remaining = len;

• unsigned int nr_pages = PAGE_ALIGN(len) >> PAGE_SHIFT;

unsigned int max_order = orders[0];   struct system_heap_priv *priv = dma_heap_get_drvdata(heap);   bool cc_shared = priv->cc_shared; @@ -416,10 +417,15 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,   struct page *page, *tmp_page;   int i, ret = -ENOMEM;

• buffer = kzalloc_obj(*buffer);
• if (!buffer)

• if (!mem_cgroup_reserve_dmabuf(memcg, GFP_KERNEL, nr_pages))

return ERR_PTR(-ENOMEM);

• buffer = kzalloc_obj(*buffer);
• if (!buffer) {

• ret = -ENOMEM;
  

• goto cancel_charge;
  

• }

INIT_LIST_HEAD(&buffer->attachments);   mutex_init(&buffer->lock);   buffer->heap = heap; @@ -473,11 +479,14 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,   exp_info.size = buffer->len;   exp_info.flags = fd_flags;   exp_info.priv = buffer;

• if (memcg)

• exp_info.memcg = memcg;
  

dmabuf = dma_buf_export(&exp_info);   if (IS_ERR(dmabuf)) {   ret = PTR_ERR(dmabuf);   goto free_pages;   }

return dmabuf;    free_pages: @@ -498,6 +507,8 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,   list_for_each_entry_safe(page, tmp_page, &pages, lru)   __free_pages(page, compound_order(page));   kfree(buffer); +cancel_charge:

• mem_cgroup_cancel_dmabuf(memcg, nr_pages);

return ERR_PTR(ret);  } diff --git a/drivers/tee/tee_heap.c b/drivers/tee/tee_heap.c index 007c00156520..83e2fbd6960b 100644 --- a/drivers/tee/tee_heap.c +++ b/drivers/tee/tee_heap.c @@ -167,7 +167,8 @@ static const struct dma_buf_ops tee_heap_buf_ops = {    static struct dma_buf *tee_dma_heap_alloc(struct dma_heap *heap,     unsigned long len, u32 fd_flags,

• 			  u64 heap_flags)
  

• 			  u64 heap_flags,
  

• 			  struct mem_cgroup *memcg)
  

{   struct tee_dma_heap *h = dma_heap_get_drvdata(heap);   DEFINE_DMA_BUF_EXPORT_INFO(exp_info); diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 23ec0ff23fba..85dd747c9b36 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -505,6 +505,9 @@ struct dma_buf_attachment {   * @flags: mode flags for the file   * @resv: reservation-object, NULL to allocate default one   * @priv: Attach private data of allocator to this buffer

• • @memcg: memcg to charge for this buffer's memory. Set only

for

• • buffers backed by system memory where @size reflects
    

the

• • actual allocation in bytes.
    

*   * This structure holds the information required to export the buffer. Used   * with dma_buf_export() only. @@ -517,6 +520,7 @@ struct dma_buf_export_info {   int flags;   struct dma_resv *resv;   void *priv;

• struct mem_cgroup *memcg;

};    /** diff --git a/include/linux/dma-heap.h b/include/linux/dma-heap.h index 648328a64b27..2d69f8432bd2 100644 --- a/include/linux/dma-heap.h +++ b/include/linux/dma-heap.h @@ -23,7 +23,8 @@ struct dma_heap_ops {   struct dma_buf *(*allocate)(struct dma_heap *heap,       unsigned long len,       u32 fd_flags,

• 		    u64 heap_flags);
  

• 		    u64 heap_flags,
  

• 		    struct mem_cgroup *memcg);
  

};    /** diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 4d1e82cf0833..f8ec751b7d7b 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -671,6 +671,8 @@ int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp);  int mem_cgroup_swapin_charge_folio(struct folio *folio, unsigned short id,      struct mm_struct *mm, gfp_t gfp);   +struct mem_cgroup *mem_cgroup_get_from_fd(int fd);

bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp,          unsigned int nr_pages);   @@ -1178,6 +1180,11 @@ static inline int mem_cgroup_swapin_charge_folio(struct folio *folio,   return 0;  }   +static inline struct mem_cgroup *mem_cgroup_get_from_fd(int fd) +{

• return ERR_PTR(-EOPNOTSUPP);

+}

static inline bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg,        gfp_t gfp,        unsigned int nr_pages) diff --git a/include/uapi/linux/dma-heap.h b/include/uapi/linux/dma- heap.h index a4cf716a49fa..bfcd1c25bc7e 100644 --- a/include/uapi/linux/dma-heap.h +++ b/include/uapi/linux/dma-heap.h @@ -29,6 +29,11 @@   * handle to the allocated dma-buf   * @fd_flags: file descriptor flags used when allocating   * @heap_flags: flags passed to heap

• • @charge_fd: optional pidfd or cgroupfd whose cgroup

should be

• • 	charged for this allocation; 0 means charge
    

the calling

• • 	process's cgroup when the mem_accounting
    

module parameter

• • 	is enabled, or skip charging otherwise
    

• • @__padding: reserved, must be zero

*   * Provided by userspace as an argument to the ioctl   */ @@ -37,6 +42,8 @@ struct dma_heap_allocation_data {   __u32 fd;   __u32 fd_flags;   __u64 heap_flags;

• __u32 charge_fd;
• __u32 __padding;

};    #define DMA_HEAP_IOC_MAGIC 'H' diff --git a/mm/memcontrol.c b/mm/memcontrol.c index e53dd7eebc3b..17fdefc56b97 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5661,6 +5661,53 @@ void mem_cgroup_flush_workqueue(void)   flush_workqueue(memcg_wq);  }   +/**

• • mem_cgroup_get_from_fd - resolve a memcg from a cgroupfd or pidfd
• • @fd: file descriptor (cgroupfd or pidfd)
• • Tries @fd as a cgroupfd first; if that fails, tries it as a

pidfd.

• • On success returns a referenced memcg pointer. On failure returns
• • an ERR_PTR.
• */

+struct mem_cgroup *mem_cgroup_get_from_fd(int fd) +{

• struct cgroup_subsys_state *css;
• struct mem_cgroup *memcg;
• struct cgroup *cgrp;
• struct task_struct *task;
• struct mm_struct *mm;
• unsigned int pidfd_flags;
• cgrp = cgroup_get_from_fd(fd);
• if (!IS_ERR(cgrp)) {

• rcu_read_lock();
  

• css = cgroup_css(cgrp, &memory_cgrp_subsys);
  

• if (!css || !css_tryget_online(css)) {
  

• 	rcu_read_unlock();
  

• 	cgroup_put(cgrp);
  

• 	return ERR_PTR(-ENOENT);
  

• }
  

• memcg = mem_cgroup_from_css(css);
  

• rcu_read_unlock();
  

• cgroup_put(cgrp);
  

• return memcg;
  

• }
• task = pidfd_get_task(fd, &pidfd_flags);
• if (IS_ERR(task))

• return ERR_CAST(task);
  

• mm = get_task_mm(task);
• put_task_struct(task);
• if (!mm)

• return ERR_PTR(-ESRCH);
  

• memcg = get_mem_cgroup_from_mm(mm);
• mmput(mm);
• return memcg ?: ERR_PTR(-ENOENT);

+}

/**   * mem_cgroup_reserve_dmabuf - charge a memcg for a dma-buf allocation   * @memcg: memcg to charge (may be %NULL)

On Thu, Nov 12, 2026 at 11:04:54AM +0100, Thomas Hellström wrote:

On Thu, 2026-11-12 at 10:56 +0100, Albert Esteve wrote:

...

On Thu, Nov 12, 2026 at 08:42:18AM +0100, Thomas Hellström wrote:

...

On Wed, 2026-11-04 at 12:09 +0100, Albert Esteve wrote:

...

On embedded platforms a central process often allocates dma-buf memory on behalf of client applications. Without a way to attribute the charge to the requesting client's cgroup, the cost lands on the allocator, making per-cgroup memory limits ineffective for the actual consumers.

Add charge_fd to struct dma_heap_allocation_data. When set to a valid pidfd or cgroupfd, DMA_HEAP_IOCTL_ALLOC resolves the target task's or cgroup's memcg and charges the buffer there via mem_cgroup_reserve_dmabuf() inside dma_heap_ioctl_allocate(). The resolved memcg is passed through dma_buf_export_info so that dma_buf_export() stores it and updates the MEMCG_DMABUF stat. Without charge_fd, and with the mem_accounting module parameter enabled, the buffer is charged to the allocator's own cgroup. The __GPF_ACCOUNT flag is removed from system heap allocations to avoid double counting.

Usage examples:

1. Central allocator charging to a client at allocation time.      The allocator knows the client's PID (e.g., from binder's      sender_pid) and uses pidfd to attribute the charge:

pid_t client_pid = txn->sender_pid;        int pidfd = pidfd_open(client_pid, 0);

struct dma_heap_allocation_data alloc = {            .len         = buffer_size,            .fd_flags    = O_RDWR | O_CLOEXEC,            .charge_fd   = pidfd,        };        ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, &alloc);        close(pidfd);        /* alloc.fd is now charged to client's cgroup */

2. Default allocation (no pidfd, mem_accounting=1).      When charge_fd is not set and the mem_accounting module      parameter is enabled, the buffer is charged to the allocator's      own cgroup:

struct dma_heap_allocation_data alloc = {            .len      = buffer_size,            .fd_flags = O_RDWR | O_CLOEXEC,        };        ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, &alloc);        /* charged to current process's cgroup */

Current limitations:

- Single-owner model: a dma-buf carries one memcg charge regardless of    how many processes share it. Means only the first owner (and exporter)    of the shared buffer bears the charge.  - Only memcg accounting supported. While this makes sense for system    heap buffers, other heaps (e.g., CMA heaps) will require selectively    charging also for the dmem controller.

Signed-off-by: Albert Esteve aesteve@redhat.com

Documentation/admin-guide/cgroup-v2.rst |  5 ++--  drivers/dma-buf/dma-buf.c               |  5 ++++  drivers/dma-buf/dma-heap.c              | 28 +++++++++++++++++--

drivers/dma-buf/heaps/cma_heap.c        |  3 ++-  drivers/dma-buf/heaps/system_heap.c     | 21 +++++++++++----  drivers/tee/tee_heap.c                  |  3 ++-  include/linux/dma-buf.h                 |  4 +++  include/linux/dma-heap.h                |  3 ++-  include/linux/memcontrol.h              |  7 +++++  include/uapi/linux/dma-heap.h           |  7 +++++  mm/memcontrol.c                         | 47 +++++++++++++++++++++++++++++++++  11 files changed, 120 insertions(+), 13 deletions(-)

diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst index a3265a4a953e..66ddba678784 100644 --- a/Documentation/admin-guide/cgroup-v2.rst +++ b/Documentation/admin-guide/cgroup-v2.rst @@ -1663,8 +1663,9 @@ The following nested keys are defined.   structures.       dmabuf (npn)

• Amount of memory used for exported DMA buffers
  

allocated by the cgroup.

• Stays with the allocating cgroup regardless of
  

how the buffer is shared.

• Amount of memory used for exported DMA buffers
  

allocated by or on

• behalf of the cgroup. Stays with the allocating
  

cgroup regardless

• of how the buffer is shared.
  

This doesn't sound right. Graphics buffers exported as DMA buffers are typically charged elsewhere, like gpu_active, and a transfer of their charge would likely stay in that key? To be consistent, shouldn't this be related to dma-heap memory and called dmaheap or something similar.

Although this work initially targeted dma heaps only, in its current form is meant to stay generic (while solving the central allocator problem). The memory exported as dma-bufs has no memory.stat of its own, and an exporter allocating plain pages (e.g., V4L2) has nowhere else to report it.

...

We should have a tighter definition of exactly what memory is to be registered here.

Yes, I will be more specific and clearly state that an exporter whose memory is already accounted must not opt in. That also naturally disallows transfers.

I would suspect (although not sure TBH) a system that uses a centralized allocator for gpu memory (even if it's accounted as gpu_active) might want to be able to transfer the charge as well, so I think the transfer mechanism might want to be generic enough to handle that.

That makes sense as a direction, but my aim for this series was to tackle the central allocator problem, that is, memory charge at dma-buf level to the cgroup an allocation is made for, and moved afterwards if needed.

For allocators that charge per page (as in Dave's series) a transfer would move each page's charges between objcgs, which is a different mechanism from the dma-buf level charge in this series.

But iiuc you feedback is in line with Christian's feedback that uAPI should not block later extension. To that end, XFER_CHARGE ioctl has a reserved flags field, so more buffer types can be potentially supported later, as they opt-in, without uAPI changes.

At least the initial design should IMO allow for a future hook to handle such transfers even for !dma-buf memory?

Not sure what you mean by hook here. A callback in the exporter? A charge op in dma_buf_ops was already objected before [1].

[1] https://lore.kernel.org/lkml/5cc27a05-8131-ce9b-dea1-5c75e994216d@amd.com/

Thanks, Thomas

...

...

Also says "Stays with the allocating cgroup regardless of how the buffer is shared", which isn't correct after the series? Perhaps that's changed in a later patch.

I missed updating the text after having added XFER_CHARGE to the series. I'll fix the wording in this patch and mention the transfer in the next one.

BR, Albert

...

Thanks, Thomas

...

workingset_refault_anon   Number of refaults of previously evicted anonymous pages. diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma- buf.c index 1c6b9cee7ac2..837666273550 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -714,6 +714,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)   struct dma_resv *resv = exp_info->resv;   struct file *file;   size_t alloc_size = sizeof(struct dma_buf);

• unsigned int nr_pages = PAGE_ALIGN(exp_info->size) >>

PAGE_SHIFT;   int ret;     if (WARN_ON(!exp_info->priv || !exp_info->ops @@ -750,6 +751,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)   dmabuf->size = exp_info->size;   dmabuf->exp_name = exp_info->exp_name;   dmabuf->owner = exp_info->owner;

• dmabuf->memcg = exp_info->memcg;

spin_lock_init(&dmabuf->name_lock);   init_waitqueue_head(&dmabuf->poll);   dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf-

...

poll;

@@ -771,6 +773,9 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)     DMA_BUF_TRACE(trace_dma_buf_export, dmabuf);

• if (dmabuf->memcg)

• mod_memcg_state(dmabuf->memcg, MEMCG_DMABUF,
  

nr_pages);

return dmabuf;    err_file: diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma- heap.c index 8a6c2b6e0cc6..7bd416ae2c23 100644 --- a/drivers/dma-buf/dma-heap.c +++ b/drivers/dma-buf/dma-heap.c @@ -10,6 +10,8 @@  #include <linux/device.h>  #include <linux/dma-buf.h>  #include <linux/dma-heap.h> +#include <linux/memcontrol.h> +#include <linux/sched/mm.h>  #include <linux/err.h>  #include <linux/export.h>  #include <linux/list.h> @@ -78,6 +80,7 @@ static struct dma_buf *dma_heap_ioctl_allocate(struct file *file, void *data)   struct dma_heap_allocation_data *heap_allocation = data;   struct dma_heap *heap = file->private_data;   struct dma_buf *dmabuf;

• struct mem_cgroup *memcg = NULL;

int fd;   size_t len;   @@ -90,15 +93,34 @@ static struct dma_buf *dma_heap_ioctl_allocate(struct file *file, void *data)   if (heap_allocation->heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS)   return ERR_PTR(-EINVAL);

• if (heap_allocation->__padding != 0)

• return ERR_PTR(-EINVAL);
  

• if (heap_allocation->charge_fd) {

• memcg = mem_cgroup_get_from_fd(heap_allocation-
  

...

charge_fd);

• if (IS_ERR(memcg))
  

• 	return ERR_CAST(memcg);
  

• }
• if (!memcg && mem_accounting)

• memcg = get_mem_cgroup_from_mm(current->mm);
  

len = PAGE_ALIGN(heap_allocation->len);

• if (!len)

• if (!len) {

• mem_cgroup_put(memcg);
  

return ERR_PTR(-EINVAL);

• }

dmabuf = heap->ops->allocate(heap, len, heap_allocation-

...

fd_flags,

• 		     heap_allocation-
  

...

heap_flags);

• 		     heap_allocation-
  

...

heap_flags,

memcg);

• if (IS_ERR(dmabuf))

• if (IS_ERR(dmabuf)) {

• mem_cgroup_put(memcg);
  

return dmabuf;

• }
• if (memcg && !dmabuf->memcg)

• mem_cgroup_put(memcg);
  

fd = get_unused_fd_flags(heap_allocation->fd_flags);   if (fd < 0) { diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma- buf/heaps/cma_heap.c index 3fb4b946c91a..04de88b468a8 100644 --- a/drivers/dma-buf/heaps/cma_heap.c +++ b/drivers/dma-buf/heaps/cma_heap.c @@ -281,7 +281,8 @@ static const struct dma_buf_ops cma_heap_buf_ops = {  static struct dma_buf *cma_heap_allocate(struct dma_heap *heap,   unsigned long len,   u32 fd_flags,

• 			 u64 heap_flags)
  

• 			 u64 heap_flags,
  

• 			 struct mem_cgroup
  

*memcg)  {   struct cma_heap *cma_heap = dma_heap_get_drvdata(heap);   struct cma_heap_buffer *buffer; diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma- buf/heaps/system_heap.c index c8959eadc71d..2bd245e1eab8 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -17,6 +17,7 @@  #include <linux/err.h>  #include <linux/highmem.h>  #include <linux/mem_encrypt.h> +#include <linux/memcontrol.h>  #include <linux/mm.h>  #include <linux/set_memory.h>  #include <linux/module.h> @@ -388,8 +389,6 @@ static struct page *alloc_largest_available(unsigned long size,   if (max_order < orders[i])   continue;   flags = order_flags[i];

• if (mem_accounting)
  

• 	flags |= __GFP_ACCOUNT;
  

page = alloc_pages(flags, orders[i]);   if (!page)   continue; @@ -401,11 +400,13 @@ static struct page *alloc_largest_available(unsigned long size,  static struct dma_buf *system_heap_allocate(struct dma_heap *heap,       unsigned long len,       u32 fd_flags,

• 			    u64 heap_flags)
  

• 			    u64 heap_flags,
  

• 			    struct mem_cgroup
  

*memcg)  {   struct system_heap_buffer *buffer;   DEFINE_DMA_BUF_EXPORT_INFO(exp_info);   unsigned long size_remaining = len;

• unsigned int nr_pages = PAGE_ALIGN(len) >> PAGE_SHIFT;

unsigned int max_order = orders[0];   struct system_heap_priv *priv = dma_heap_get_drvdata(heap);   bool cc_shared = priv->cc_shared; @@ -416,10 +417,15 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,   struct page *page, *tmp_page;   int i, ret = -ENOMEM;

• buffer = kzalloc_obj(*buffer);
• if (!buffer)

• if (!mem_cgroup_reserve_dmabuf(memcg, GFP_KERNEL,

nr_pages))   return ERR_PTR(-ENOMEM);

• buffer = kzalloc_obj(*buffer);
• if (!buffer) {

• ret = -ENOMEM;
  

• goto cancel_charge;
  

• }

INIT_LIST_HEAD(&buffer->attachments);   mutex_init(&buffer->lock);   buffer->heap = heap; @@ -473,11 +479,14 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,   exp_info.size = buffer->len;   exp_info.flags = fd_flags;   exp_info.priv = buffer;

• if (memcg)

• exp_info.memcg = memcg;
  

dmabuf = dma_buf_export(&exp_info);   if (IS_ERR(dmabuf)) {   ret = PTR_ERR(dmabuf);   goto free_pages;   }

return dmabuf;    free_pages: @@ -498,6 +507,8 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap,   list_for_each_entry_safe(page, tmp_page, &pages, lru)   __free_pages(page, compound_order(page));   kfree(buffer); +cancel_charge:

• mem_cgroup_cancel_dmabuf(memcg, nr_pages);

return ERR_PTR(ret);  } diff --git a/drivers/tee/tee_heap.c b/drivers/tee/tee_heap.c index 007c00156520..83e2fbd6960b 100644 --- a/drivers/tee/tee_heap.c +++ b/drivers/tee/tee_heap.c @@ -167,7 +167,8 @@ static const struct dma_buf_ops tee_heap_buf_ops = {    static struct dma_buf *tee_dma_heap_alloc(struct dma_heap *heap,     unsigned long len, u32 fd_flags,

• 			  u64 heap_flags)
  

• 			  u64 heap_flags,
  

• 			  struct mem_cgroup
  

*memcg)  {   struct tee_dma_heap *h = dma_heap_get_drvdata(heap);   DEFINE_DMA_BUF_EXPORT_INFO(exp_info); diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 23ec0ff23fba..85dd747c9b36 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -505,6 +505,9 @@ struct dma_buf_attachment {   * @flags: mode flags for the file   * @resv: reservation-object, NULL to allocate default one   * @priv: Attach private data of allocator to this buffer

• • @memcg: memcg to charge for this buffer's memory. Set

only for

• • buffers backed by system memory where @size
    

reflects the

• • actual allocation in bytes.
    

*   * This structure holds the information required to export the buffer. Used   * with dma_buf_export() only. @@ -517,6 +520,7 @@ struct dma_buf_export_info {   int flags;   struct dma_resv *resv;   void *priv;

• struct mem_cgroup *memcg;

};    /** diff --git a/include/linux/dma-heap.h b/include/linux/dma-heap.h index 648328a64b27..2d69f8432bd2 100644 --- a/include/linux/dma-heap.h +++ b/include/linux/dma-heap.h @@ -23,7 +23,8 @@ struct dma_heap_ops {   struct dma_buf *(*allocate)(struct dma_heap *heap,       unsigned long len,       u32 fd_flags,

• 		    u64 heap_flags);
  

• 		    u64 heap_flags,
  

• 		    struct mem_cgroup *memcg);
  

};    /** diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 4d1e82cf0833..f8ec751b7d7b 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -671,6 +671,8 @@ int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp);  int mem_cgroup_swapin_charge_folio(struct folio *folio, unsigned short id,      struct mm_struct *mm, gfp_t gfp);   +struct mem_cgroup *mem_cgroup_get_from_fd(int fd);

bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp,          unsigned int nr_pages);   @@ -1178,6 +1180,11 @@ static inline int mem_cgroup_swapin_charge_folio(struct folio *folio,   return 0;  }   +static inline struct mem_cgroup *mem_cgroup_get_from_fd(int fd) +{

• return ERR_PTR(-EOPNOTSUPP);

+}

static inline bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg,        gfp_t gfp,        unsigned int nr_pages) diff --git a/include/uapi/linux/dma-heap.h b/include/uapi/linux/dma- heap.h index a4cf716a49fa..bfcd1c25bc7e 100644 --- a/include/uapi/linux/dma-heap.h +++ b/include/uapi/linux/dma-heap.h @@ -29,6 +29,11 @@   * handle to the allocated dma-buf   * @fd_flags: file descriptor flags used when allocating   * @heap_flags: flags passed to heap

• • @charge_fd: optional pidfd or cgroupfd whose cgroup

should be

• • 	charged for this allocation; 0 means
    

charge the calling

• • 	process's cgroup when the mem_accounting
    

module parameter

• • 	is enabled, or skip charging otherwise
    

• • @__padding: reserved, must be zero

*   * Provided by userspace as an argument to the ioctl   */ @@ -37,6 +42,8 @@ struct dma_heap_allocation_data {   __u32 fd;   __u32 fd_flags;   __u64 heap_flags;

• __u32 charge_fd;
• __u32 __padding;

};    #define DMA_HEAP_IOC_MAGIC 'H' diff --git a/mm/memcontrol.c b/mm/memcontrol.c index e53dd7eebc3b..17fdefc56b97 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5661,6 +5661,53 @@ void mem_cgroup_flush_workqueue(void)   flush_workqueue(memcg_wq);  }   +/**

• • mem_cgroup_get_from_fd - resolve a memcg from a cgroupfd or

pidfd

• • @fd: file descriptor (cgroupfd or pidfd)
• • Tries @fd as a cgroupfd first; if that fails, tries it as a

pidfd.

• • On success returns a referenced memcg pointer. On failure

returns

• • an ERR_PTR.
• */

+struct mem_cgroup *mem_cgroup_get_from_fd(int fd) +{

• struct cgroup_subsys_state *css;
• struct mem_cgroup *memcg;
• struct cgroup *cgrp;
• struct task_struct *task;
• struct mm_struct *mm;
• unsigned int pidfd_flags;
• cgrp = cgroup_get_from_fd(fd);
• if (!IS_ERR(cgrp)) {

• rcu_read_lock();
  

• css = cgroup_css(cgrp, &memory_cgrp_subsys);
  

• if (!css || !css_tryget_online(css)) {
  

• 	rcu_read_unlock();
  

• 	cgroup_put(cgrp);
  

• 	return ERR_PTR(-ENOENT);
  

• }
  

• memcg = mem_cgroup_from_css(css);
  

• rcu_read_unlock();
  

• cgroup_put(cgrp);
  

• return memcg;
  

• }
• task = pidfd_get_task(fd, &pidfd_flags);
• if (IS_ERR(task))

• return ERR_CAST(task);
  

• mm = get_task_mm(task);
• put_task_struct(task);
• if (!mm)

• return ERR_PTR(-ESRCH);
  

• memcg = get_mem_cgroup_from_mm(mm);
• mmput(mm);
• return memcg ?: ERR_PTR(-ENOENT);

+}

/**   * mem_cgroup_reserve_dmabuf - charge a memcg for a dma-buf allocation   * @memcg: memcg to charge (may be %NULL)

On 11/4/26 12:09, Albert Esteve wrote:

dma-heap already supports charging a specific cgroup at allocation time via charge_fd in DMA_HEAP_IOCTL_ALLOC. However, dma-bufs can originate from any exporter (DRM, V4L2, etc.), and the allocator may not know the final owner at allocation time.

Add DMA_BUF_IOCTL_XFER_CHARGE to transfer a dma-buf's memcg charge to a different cgroup after allocation. The target is identified by charge_fd, which may be a cgroupfd or a pidfd.

The transfer charges the new cgroup before uncharging the old one, preserving the original charge on failure. Concurrent transfers are serialized by the dma-buf reservation lock, so lockdep covers the locking order of the charge path early. The transfer implementation is generic (mem_cgroup_transfer_charge) and not dma-buf specific, so it can be reused by other subsystems.

Not all dma-buf exporters back their buffers with reclaimable system memory. Some represent device registers, VRAM, or carved-out pools where size is not a meaningful memory cost. The xfer ioctl returns -EOPNOTSUPP for buffers whose memcg is not set. Exporters opt in by passing a memcg through dma_buf_export_info at export time. Currently only the system heap sets it, other exporters can opt in as needed.

Usage example: int cg_fd = open("/sys/fs/cgroup/clients/app1", O_RDONLY | O_DIRECTORY);

struct dma_buf_transfer_charge xfer = { .charge_fd = cg_fd, }; ioctl(dmabuf_fd, DMA_BUF_IOCTL_XFER_CHARGE, &xfer); /* charge now on app1's cgroup */ close(cg_fd);

Signed-off-by: Albert Esteve aesteve@redhat.com

drivers/dma-buf/dma-buf.c | 42 ++++++++++++++++++++++++++++++++++++++++++ include/linux/dma-buf.h | 3 ++- include/linux/memcontrol.h | 13 +++++++++++++ include/uapi/linux/dma-buf.h | 26 ++++++++++++++++++++++++++ mm/memcontrol.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 125 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 837666273550..3bd26fbb1109 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -540,6 +540,45 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf, } #endif +/* Transfer a dma-buf's memcg charge; see struct dma_buf_transfer_charge */ +static long dma_buf_xfer_charge(struct dma_buf *dmabuf,

• 		const void __user *user_data)
  

+{

• struct dma_buf_transfer_charge arg;
• struct mem_cgroup *memcg;
• unsigned int nr_pages = PAGE_ALIGN(dmabuf->size) >> PAGE_SHIFT;
• int ret = 0;
• if (copy_from_user(&arg, user_data, sizeof(arg)))

• return -EFAULT;
  

• if (!IS_ENABLED(CONFIG_MEMCG))

• return 0;
  

• if (arg.flags != 0)

• return -EINVAL;
  

• memcg = mem_cgroup_get_from_fd(arg.charge_fd);
• if (IS_ERR(memcg))

• return PTR_ERR(memcg);
  

• dma_resv_lock(dmabuf->resv, NULL);
• if (!dmabuf->memcg) {

• ret = -EOPNOTSUPP;
  

• goto out;
  

• }
• if (dmabuf->memcg != memcg &&

•    !mem_cgroup_transfer_charge(&dmabuf->memcg, memcg, MEMCG_DMABUF, nr_pages))
  

Please move the calculation of nr_pages after taking the dma_resv_lock().

We currently don't have anybody dynamically changing DMA-buf sizes but just to be on the save side.

With that done Reviewed-by: Christian König christian.koenig@amd.com

Regards, Christian.

• ret = -ENOMEM;
  

+out:

• dma_resv_unlock(dmabuf->resv);
• mem_cgroup_put(memcg);
• return ret;

+}

static long dma_buf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -590,6 +629,9 @@ static long dma_buf_ioctl(struct file *file, return dma_buf_import_sync_file(dmabuf, (const void __user *)arg); #endif

• case DMA_BUF_IOCTL_XFER_CHARGE:

• return dma_buf_xfer_charge(dmabuf, (const void __user *)arg);
  

• default: return -ENOTTY; }

diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 85dd747c9b36..b01149d26b44 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -507,7 +507,8 @@ struct dma_buf_attachment {

• @priv: Attach private data of allocator to this buffer
• @memcg: memcg to charge for this buffer's memory. Set only for

• buffers backed by system memory where @size reflects the
  

• • actual allocation in bytes.
    

• • actual allocation in bytes. Enables charge transfer via
    

• • DMA_BUF_IOCTL_XFER_CHARGE.
    

  • This structure holds the information required to export the buffer. Used
  • with dma_buf_export() only.

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index f8ec751b7d7b..af02d9777fe9 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -676,6 +676,11 @@ struct mem_cgroup *mem_cgroup_get_from_fd(int fd); bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp, unsigned int nr_pages); +bool mem_cgroup_transfer_charge(struct mem_cgroup **ptr_memcg,

• 		struct mem_cgroup *new_memcg,
  

• 		enum memcg_stat_item item,
  

• 		unsigned int nr_pages);
  

void __mem_cgroup_uncharge(struct folio *folio); /** @@ -1197,6 +1202,14 @@ static inline void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, { } +static inline bool mem_cgroup_transfer_charge(struct mem_cgroup **ptr_memcg,

• 			      struct mem_cgroup *new_memcg,
  

• 			      enum memcg_stat_item item,
  

• 			      unsigned int nr_pages)
  

+{

• return true;

+}

static inline void mem_cgroup_uncharge(struct folio *folio) { } diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma-buf.h index e827c9d20c5d..0aaf2e7d593b 100644 --- a/include/uapi/linux/dma-buf.h +++ b/include/uapi/linux/dma-buf.h @@ -168,6 +168,31 @@ struct dma_buf_import_sync_file { __s32 fd; }; +/**

• • struct dma_buf_transfer_charge - Transfer a dma-buf's memcg charge
• • Any holder of a dma-buf file descriptor can perform a
• • DMA_BUF_IOCTL_XFER_CHARGE to attribute the buffer's memory
• • cost to a specific cgroup, or move it from one cgroup to
• • another. The ioctl charges the new cgroup before uncharging
• • the old one atomically. On failure the original charge is
• • preserved. If the buffer has no existing memcg charge, the
• • ioctl returns -EOPNOTSUPP.
• */

+struct dma_buf_transfer_charge {

• /** @flags: Reserved, must be zero */
• __u32 flags; /* unused for now */
• /**

• * @charge_fd: File descriptor identifying the target cgroup.
  

• *
  

• * May be either a pidfd, in which case the charge moves to the
  

• * memory cgroup of the referenced process, or a cgroupfd obtained
  

• * by opening a cgroup v2 directory, in which case the charge moves
  

• * directly to that cgroup's memory controller.
  

• */
  

• __u32 charge_fd;

+};

#define DMA_BUF_BASE 'b' #define DMA_BUF_IOCTL_SYNC _IOW(DMA_BUF_BASE, 0, struct dma_buf_sync) @@ -179,5 +204,6 @@ struct dma_buf_import_sync_file { #define DMA_BUF_SET_NAME_B _IOW(DMA_BUF_BASE, 1, __u64) #define DMA_BUF_IOCTL_EXPORT_SYNC_FILE _IOWR(DMA_BUF_BASE, 2, struct dma_buf_export_sync_file) #define DMA_BUF_IOCTL_IMPORT_SYNC_FILE _IOW(DMA_BUF_BASE, 3, struct dma_buf_import_sync_file) +#define DMA_BUF_IOCTL_XFER_CHARGE _IOW(DMA_BUF_BASE, 4, struct dma_buf_transfer_charge) #endif diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 17fdefc56b97..3e717b5663c8 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5752,6 +5752,48 @@ void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, unsigned int nr_pages) } EXPORT_SYMBOL_GPL(mem_cgroup_cancel_dmabuf); +/**

• • mem_cgroup_transfer_charge - move a charge between memcgs
• • @ptr_memcg: pointer to the memcg to transfer from
• • @new_memcg: target memcg; caller must hold a reference
• • @item: stat counter to adjust
• • @nr_pages: number of pages to transfer
• • Transfers @nr_pages of charge from *@ptr_memcg to @new_memcg and, on
• • success, stores @new_memcg in *@ptr_memcg.
• • Updates to *@ptr_memcg must be serialized by the caller.
• • Returns %true on success, %false if the charge against @new_memcg
• • failed.
• */

+bool mem_cgroup_transfer_charge(struct mem_cgroup **ptr_memcg,

• 		struct mem_cgroup *new_memcg,
  

• 		enum memcg_stat_item item,
  

• 		unsigned int nr_pages)
  

+{

• struct mem_cgroup *old_memcg = *ptr_memcg;
• if (!new_memcg || mem_cgroup_disabled())

• return true;
  

• if (try_charge(new_memcg, GFP_KERNEL, nr_pages))

• return false;
  

• mod_memcg_state(new_memcg, item, nr_pages);
• css_get(&new_memcg->css);
• *ptr_memcg = new_memcg;
• if (old_memcg) {

• /* Uncharge old cgroup */
  

• mod_memcg_state(old_memcg, item, -nr_pages);
  

• if (!mem_cgroup_is_root(old_memcg))
  

• 	refill_stock(old_memcg, nr_pages);
  

• mem_cgroup_put(old_memcg);
  

• }
• return true;

+}

/**

• mem_cgroup_uncharge_dmabuf - uncharge a dma-buf from its memcg
• @dmabuf: buffer to uncharge

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] dma-buf: unprivileged cgroup escape and OOM via dma_buf_xfer_charge() - [Medium] dma-buf: broken !CONFIG_MEMCG and disabled-memcg handling in dma_buf_xfer_charge() --

commit 3f75f95a079fdfc2b4d2659ae4dbea6726be45ad Author: Albert Esteve aesteve@redhat.com

dma-buf: transfer memcg charges via DMA_BUF_IOCTL_XFER_CHARGE

This commit adds the DMA_BUF_IOCTL_XFER_CHARGE ioctl and a generic mem_cgroup_transfer_charge() helper to transfer a dma-buf's memory cgroup charge to a target cgroup identified by a cgroupfd or pidfd.

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 8376662735502..3bd26fbb11092 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -540,6 +540,45 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf, } #endif +/* Transfer a dma-buf's memcg charge; see struct dma_buf_transfer_charge */ +static long dma_buf_xfer_charge(struct dma_buf *dmabuf,

• 		const void __user *user_data)
  

+{

• struct dma_buf_transfer_charge arg;
• struct mem_cgroup *memcg;
• unsigned int nr_pages = PAGE_ALIGN(dmabuf->size) >> PAGE_SHIFT;
• int ret = 0;
• if (copy_from_user(&arg, user_data, sizeof(arg)))

• return -EFAULT;
  

• if (!IS_ENABLED(CONFIG_MEMCG))

• return 0;
  

[Severity: Medium] As reported by Sashiko on v3 [1], when CONFIG_MEMCG is disabled, dma_buf_xfer_charge() returns 0 before checking arg.flags, mem_cgroup_get_from_fd(arg.charge_fd), or dmabuf->memcg.

On a CONFIG_MEMCG=n kernel, won't this accept non-zero arg.flags instead of returning -EINVAL, and return 0 instead of -EOPNOTSUPP on buffers that have no existing memcg charge?

In include/uapi/linux/dma-buf.h, struct dma_buf_transfer_charge documents that flags must be zero and that the ioctl returns -EOPNOTSUPP if the buffer has no existing memcg charge. In include/linux/memcontrol.h, the !CONFIG_MEMCG stub for mem_cgroup_get_from_fd() already returns ERR_PTR(-EOPNOTSUPP):

include/linux/memcontrol.h: static inline struct mem_cgroup *mem_cgroup_get_from_fd(int fd) { return ERR_PTR(-EOPNOTSUPP); }

Returning 0 early here bypasses that stub and leaves the !CONFIG_MEMCG stub for mem_cgroup_transfer_charge() in include/linux/memcontrol.h unreachable.

In addition, in mm/memcontrol.c, mem_cgroup_transfer_charge() has:

if (!new_memcg || mem_cgroup_disabled()) return true;

which returns true without updating *ptr_memcg or uncharging and dropping the reference to old_memcg, even though the function comment states that on success it stores new_memcg in *ptr_memcg. Should the early CONFIG_MEMCG check in dma_buf_xfer_charge() be dropped so it falls through to arg.flags validation and mem_cgroup_get_from_fd()?

• if (arg.flags != 0)

• return -EINVAL;
  

• memcg = mem_cgroup_get_from_fd(arg.charge_fd);
• if (IS_ERR(memcg))

• return PTR_ERR(memcg);
  

• dma_resv_lock(dmabuf->resv, NULL);
• if (!dmabuf->memcg) {

• ret = -EOPNOTSUPP;
  

• goto out;
  

• }
• if (dmabuf->memcg != memcg &&

•    !mem_cgroup_transfer_charge(&dmabuf->memcg, memcg, MEMCG_DMABUF, nr_pages))
  

• ret = -ENOMEM;
  

[Severity: High] As reported by Sashiko on v3 [2], can an unprivileged holder of a dma-buf file descriptor use dma_buf_xfer_charge() to escape its own memory cgroup limits or trigger reclaim and OOM kills in another cgroup?

In dma_buf_ioctl() -> dma_buf_xfer_charge() -> mem_cgroup_get_from_fd(), neither dma_buf_xfer_charge() nor mem_cgroup_get_from_fd() checks DAC permissions, capabilities (such as CAP_SYS_RESOURCE or CAP_SYS_ADMIN), cgroup v2 write/delegation permissions (such as cgroup_procs_write_permission() used by CLONE_INTO_CGROUP), or task access permissions (such as ptrace_may_access()) on either the source cgroup (dmabuf->memcg) or the target cgroup/task (memcg):

mm/memcontrol.c:mem_cgroup_get_from_fd() { cgrp = cgroup_get_from_fd(fd); if (!IS_ERR(cgrp)) { ... return memcg; }

task = pidfd_get_task(fd, &pidfd_flags); ... }

Because /sys/fs/cgroup directories are world-readable (0755) by default and pidfd_open() requires no privileges for visible PIDs, any unprivileged process can open /sys/fs/cgroup (root_mem_cgroup) or another cgroup's directory or pidfd.

Even with the subsequent LSM and SELinux patches in this series: 1. On systems without SELinux (such as AppArmor, Smack, or CONFIG_SECURITY=n), security_dma_buf_charge_cgroup() and security_dma_buf_charge_task() return 0 with no baseline DAC, cgroup permission, or capability checks. 2. On SELinux systems, selinux_dma_buf_charge_cgroup() checks kernfs_xattr_get(cgrp->kn, XATTR_NAME_SELINUX, NULL, 0) and returns 0 on -ENODATA whenever a cgroup directory lacks an explicit security.selinux xattr (including /sys/fs/cgroup and cgroups labeled via default genfscon policy rules). 3. Neither dma_buf_xfer_charge() nor the LSM hooks check whether the caller is authorized to uncharge the source cgroup (dmabuf->memcg).

When mem_cgroup_transfer_charge() runs:

mm/memcontrol.c:mem_cgroup_transfer_charge() { ... if (try_charge(new_memcg, GFP_KERNEL, nr_pages)) return false; ... if (old_memcg) { /* Uncharge old cgroup */ mod_memcg_state(old_memcg, item, -nr_pages); if (!mem_cgroup_is_root(old_memcg)) refill_stock(old_memcg, nr_pages); mem_cgroup_put(old_memcg); } }

A confined process can pass an fd for /sys/fs/cgroup (where try_charge() on root_mem_cgroup is a no-op) to uncharge its own cgroup and bypass memory.max, or pass an fd for another cgroup to trigger GFP_KERNEL direct reclaim and mem_cgroup_oom() in that victim cgroup. Should dma_buf_xfer_charge() or mem_cgroup_get_from_fd() enforce baseline cgroup write/task permissions and authorization to uncharge dmabuf->memcg?

[1] https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-7-78d... [2] https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-7-78d...

On Thu, Nov 12, 2026 at 08:46:02AM +0100, Thomas Hellström wrote:

On Wed, 2026-11-04 at 12:09 +0100, Albert Esteve wrote:

...

dma-heap already supports charging a specific cgroup at allocation time via charge_fd in DMA_HEAP_IOCTL_ALLOC. However, dma-bufs can originate from any exporter (DRM, V4L2, etc.), and the allocator may not know the final owner at allocation time.

Add DMA_BUF_IOCTL_XFER_CHARGE to transfer a dma-buf's memcg charge to a different cgroup after allocation. The target is identified by charge_fd, which may be a cgroupfd or a pidfd.

The transfer charges the new cgroup before uncharging the old one, preserving the original charge on failure. Concurrent transfers are serialized by the dma-buf reservation lock, so lockdep covers the locking order of the charge path early. The transfer implementation is generic (mem_cgroup_transfer_charge) and not dma-buf specific, so it can be reused by other subsystems.

Not all dma-buf exporters back their buffers with reclaimable system memory. Some represent device registers, VRAM, or carved-out pools where size is not a meaningful memory cost. The xfer ioctl returns -EOPNOTSUPP for buffers whose memcg is not set. Exporters opt in by passing a memcg through dma_buf_export_info at export time. Currently only the system heap sets it, other exporters can opt in as needed.

Usage example:   int cg_fd = open("/sys/fs/cgroup/clients/app1", O_RDONLY | O_DIRECTORY);

struct dma_buf_transfer_charge xfer = {       .charge_fd = cg_fd,   };   ioctl(dmabuf_fd, DMA_BUF_IOCTL_XFER_CHARGE, &xfer);   /* charge now on app1's cgroup */   close(cg_fd);

Signed-off-by: Albert Esteve aesteve@redhat.com

drivers/dma-buf/dma-buf.c    | 42 ++++++++++++++++++++++++++++++++++++++++++  include/linux/dma-buf.h      |  3 ++-  include/linux/memcontrol.h   | 13 +++++++++++++  include/uapi/linux/dma-buf.h | 26 ++++++++++++++++++++++++++  mm/memcontrol.c              | 42 ++++++++++++++++++++++++++++++++++++++++++  5 files changed, 125 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 837666273550..3bd26fbb1109 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -540,6 +540,45 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf,  }  #endif   +/* Transfer a dma-buf's memcg charge; see struct dma_buf_transfer_charge */ +static long dma_buf_xfer_charge(struct dma_buf *dmabuf,

• 		const void __user *user_data)
  

+{

• struct dma_buf_transfer_charge arg;
• struct mem_cgroup *memcg;
• unsigned int nr_pages = PAGE_ALIGN(dmabuf->size) >>

PAGE_SHIFT;

• int ret = 0;
• if (copy_from_user(&arg, user_data, sizeof(arg)))

• return -EFAULT;
  

• if (!IS_ENABLED(CONFIG_MEMCG))

• return 0;
  

• if (arg.flags != 0)

• return -EINVAL;
  

• memcg = mem_cgroup_get_from_fd(arg.charge_fd);
• if (IS_ERR(memcg))

• return PTR_ERR(memcg);
  

• dma_resv_lock(dmabuf->resv, NULL);
• if (!dmabuf->memcg) {

• ret = -EOPNOTSUPP;
  

• goto out;
  

• }
• if (dmabuf->memcg != memcg &&
• !mem_cgroup_transfer_charge(&dmabuf->memcg, memcg,

MEMCG_DMABUF, nr_pages))

• ret = -ENOMEM;
  

+out:

• dma_resv_unlock(dmabuf->resv);
• mem_cgroup_put(memcg);
• return ret;

+}

static long dma_buf_ioctl(struct file *file,     unsigned int cmd, unsigned long arg)  { @@ -590,6 +629,9 @@ static long dma_buf_ioctl(struct file *file,   return dma_buf_import_sync_file(dmabuf, (const void __user *)arg);  #endif

• case DMA_BUF_IOCTL_XFER_CHARGE:

• return dma_buf_xfer_charge(dmabuf, (const void
  

__user *)arg);

default:   return -ENOTTY;   } diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 85dd747c9b36..b01149d26b44 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -507,7 +507,8 @@ struct dma_buf_attachment {   * @priv: Attach private data of allocator to this buffer   * @memcg: memcg to charge for this buffer's memory. Set only for   * buffers backed by system memory where @size reflects the

• • actual allocation in bytes.
    

• • actual allocation in bytes. Enables charge transfer
    

via

• • DMA_BUF_IOCTL_XFER_CHARGE.
    

*   * This structure holds the information required to export the buffer. Used   * with dma_buf_export() only. diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index f8ec751b7d7b..af02d9777fe9 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -676,6 +676,11 @@ struct mem_cgroup *mem_cgroup_get_from_fd(int fd);  bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp,          unsigned int nr_pages);   +bool mem_cgroup_transfer_charge(struct mem_cgroup **ptr_memcg,

• 		struct mem_cgroup *new_memcg,
  

• 		enum memcg_stat_item item,
  

• 		unsigned int nr_pages);
  

void __mem_cgroup_uncharge(struct folio *folio);    /** @@ -1197,6 +1202,14 @@ static inline void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg,  {  }   +static inline bool mem_cgroup_transfer_charge(struct mem_cgroup **ptr_memcg,

• 			      struct mem_cgroup
  

*new_memcg,

• 			      enum memcg_stat_item
  

item,

• 			      unsigned int nr_pages)
  

+{

• return true;

+}

static inline void mem_cgroup_uncharge(struct folio *folio)  {  } diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma- buf.h index e827c9d20c5d..0aaf2e7d593b 100644 --- a/include/uapi/linux/dma-buf.h +++ b/include/uapi/linux/dma-buf.h @@ -168,6 +168,31 @@ struct dma_buf_import_sync_file {   __s32 fd;  };   +/**

• • struct dma_buf_transfer_charge - Transfer a dma-buf's memcg

charge

• • Any holder of a dma-buf file descriptor can perform a
• • DMA_BUF_IOCTL_XFER_CHARGE to attribute the buffer's memory
• • cost to a specific cgroup, or move it from one cgroup to
• • another.  The ioctl charges the new cgroup before uncharging
• • the old one atomically.  On failure the original charge is
• • preserved.  If the buffer has no existing memcg charge, the
• • ioctl returns -EOPNOTSUPP.
• */

+struct dma_buf_transfer_charge {

• /** @flags: Reserved, must be zero */
• __u32 flags; /* unused for now */
• /**

• * @charge_fd: File descriptor identifying the target
  

cgroup.

• *
  

• * May be either a pidfd, in which case the charge moves to
  

the

• * memory cgroup of the referenced process, or a cgroupfd
  

obtained

• * by opening a cgroup v2 directory, in which case the
  

charge moves

• * directly to that cgroup's memory controller.
  

• */
  

• __u32 charge_fd;

+};

#define DMA_BUF_BASE 'b'  #define DMA_BUF_IOCTL_SYNC _IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)   @@ -179,5 +204,6 @@ struct dma_buf_import_sync_file {  #define DMA_BUF_SET_NAME_B _IOW(DMA_BUF_BASE, 1, __u64)  #define DMA_BUF_IOCTL_EXPORT_SYNC_FILE _IOWR(DMA_BUF_BASE, 2, struct dma_buf_export_sync_file)  #define DMA_BUF_IOCTL_IMPORT_SYNC_FILE _IOW(DMA_BUF_BASE, 3, struct dma_buf_import_sync_file) +#define DMA_BUF_IOCTL_XFER_CHARGE _IOW(DMA_BUF_BASE, 4, struct dma_buf_transfer_charge)    #endif diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 17fdefc56b97..3e717b5663c8 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5752,6 +5752,48 @@ void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, unsigned int nr_pages)  }  EXPORT_SYMBOL_GPL(mem_cgroup_cancel_dmabuf);   +/**

• • mem_cgroup_transfer_charge - move a charge between memcgs
• • @ptr_memcg: pointer to the memcg to transfer from
• • @new_memcg: target memcg; caller must hold a reference
• • @item: stat counter to adjust
• • @nr_pages: number of pages to transfer
• • Transfers @nr_pages of charge from *@ptr_memcg to @new_memcg and,

on

• • success, stores @new_memcg in *@ptr_memcg.
• • Updates to *@ptr_memcg must be serialized by the caller.
• • Returns %true on success, %false if the charge against @new_memcg
• • failed.
• */

+bool mem_cgroup_transfer_charge(struct mem_cgroup **ptr_memcg,

• 		struct mem_cgroup *new_memcg,
  

• 		enum memcg_stat_item item,
  

• 		unsigned int nr_pages)
  

+{

• struct mem_cgroup *old_memcg = *ptr_memcg;
• if (!new_memcg || mem_cgroup_disabled())

• return true;
  

• if (try_charge(new_memcg, GFP_KERNEL, nr_pages))

• return false;
  

• mod_memcg_state(new_memcg, item, nr_pages);
• css_get(&new_memcg->css);
• *ptr_memcg = new_memcg;
• if (old_memcg) {

• /* Uncharge old cgroup */
  

• mod_memcg_state(old_memcg, item, -nr_pages);
  

• if (!mem_cgroup_is_root(old_memcg))
  

• 	refill_stock(old_memcg, nr_pages);
  

• mem_cgroup_put(old_memcg);
  

• }
• return true;

+}

This has the same lifetime issue as patch 1. After a transfer, the buffer pins new_memcg until it is released, and with cross-process transfers the target may be removed before the buffer is. Since this helper is meant to be reused by other subsystems, would it be better to have it take and store an obj_cgroup from the start?

Agreed. I will switch to obj_cgroup through the series.

Thanks, Thomas

...

/**   * mem_cgroup_uncharge_dmabuf - uncharge a dma-buf from its memcg   * @dmabuf: buffer to uncharge

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] mm: memcontrol: task cred and mm->owner mismatch in mem_cgroup_get_from_fd() --

commit 8654d1fa67f56b32794f6b84163f6fcd4bd83d11 Author: Albert Esteve aesteve@redhat.com

security: dma-buf: Add dma_buf_charge_task LSM hook

This commit introduces the security_dma_buf_charge_task() LSM hook and calls it in mem_cgroup_get_from_fd() when resolving a target cgroup from a pidfd.

diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 3e717b5663c82..dd276e1230cc4 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c

[ ... ]

@@ -5698,6 +5701,14 @@ struct mem_cgroup *mem_cgroup_get_from_fd(int fd) if (IS_ERR(task)) return ERR_CAST(task);

• tcred = get_task_cred(task);
• ret = security_dma_buf_charge_task(current_cred(), tcred);
• put_cred(tcred);
• if (ret) {

• put_task_struct(task);
  

• return ERR_PTR(ret);
  

• }
• mm = get_task_mm(task); put_task_struct(task); if (!mm)

[Severity: High] As reported by Sashiko on v3 [1], in mem_cgroup_get_from_fd(), security_dma_buf_charge_task(current_cred(), tcred) checks the credentials of task obtained via get_task_cred(task), while the charged mem_cgroup is then resolved indirectly via get_task_mm(task) and get_mem_cgroup_from_mm(mm):

mm/memcontrol.c:get_mem_cgroup_from_mm() { rcu_read_lock(); do { memcg = mem_cgroup_from_task(rcu_dereference(mm->owner)); if (unlikely(!memcg)) memcg = root_mem_cgroup; } while (!css_tryget(&memcg->css)); rcu_read_unlock(); return memcg; }

If task exits between get_task_mm(task) and get_mem_cgroup_from_mm(mm), exit_mm() clears task->mm and calls mm_update_next_owner(mm), which sees mm_users > 1 with no live task using mm and sets mm->owner to NULL:

kernel/exit.c:mm_update_next_owner() { ... WRITE_ONCE(mm->owner, NULL); ... }

In that case, get_mem_cgroup_from_mm(mm) falls back to returning root_mem_cgroup, where try_charge() skips accounting because mem_cgroup_is_root(memcg) is true. Could a confined process fork a short-lived helper child with matching credentials to pass security_dma_buf_charge_task() and race its exit to charge or transfer dma-buf allocations to root_mem_cgroup, escaping its cgroup memory limit?

Similarly, if task shares an mm_struct with another task via clone(CLONE_VM) that has different credentials or cgroup membership, mm->owner may not be task. Could security_dma_buf_charge_task() validate task's credentials while get_mem_cgroup_from_mm(mm) charges the cgroup of a different mm->owner task?

[1] https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-3-78d...

On Thu, Nov 5, 2026 at 12:12 PM sashiko-bot@kernel.org wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

• [Medium] selinux: one-off dma_buf class instead of general cgroup access control model

--

commit 675e985fff50ea6716b8c00023a75c07ff345a6f Author: Albert Esteve aesteve@redhat.com

selinux: Restrict cross-cgroup dma-buf charging

This commit implements the selinux_dma_buf_charge_task() hook and adds a new dma_buf object class with a charge_task permission in SELinux to restrict cross-cgroup dma-buf memory charging.

...

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 30776b0107f29..8f39d91eabc97 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2204,6 +2204,12 @@ static int selinux_capable(const struct cred *cred, struct user_namespace *ns, return cred_has_capability(cred, cap, opts, ns == &init_user_ns); }

+static int selinux_dma_buf_charge_task(const struct cred *from, const struct cred *to) +{

• return avc_has_perm(cred_sid(from), cred_sid(to),
  

•                     SECCLASS_DMA_BUF, DMA_BUF__CHARGE_TASK, NULL);
  

+}

static int selinux_quotactl(int cmds, int type, int id, const struct super_block *sb) { const struct cred *cred = current_cred();

[ ... ]

...

diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 90cb61b164256..b4ebedc6e4240 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -181,6 +181,7 @@ const struct security_class_mapping secclass_map[] = { { "user_namespace", { "create", NULL } }, { "memfd_file", { COMMON_FILE_PERMS, "execute_no_trans", "entrypoint", NULL } },

• { "dma_buf", { "charge_task", NULL } },
  

[Severity: Medium] As reported by Paul Moore on RFC [1], adding a one-off SELinux object class and permission for a specific subsystem's cgroup charging (previously dma_heap with charge_to, now dma_buf with charge_task in secclass_map[] and selinux_dma_buf_charge_task(), along with charge_cgroup in a later patch in this series) introduces a narrow, subsystem-specific policy class rather than a general cgroup and resource access control model for SELinux.

Although resolving the target memcg from charge_fd moved into generic memcontrol code in mem_cgroup_get_from_fd(), the SELinux hook in selinux_dma_buf_charge_task() and class definition in secclass_map[] still define a dma-buf-specific class instead of a broader cgroup access control abstraction.

Should this permission check be designed around a general cgroup or resource SELinux object class rather than a one-off dma_buf class?

[1] https://lore.kernel.org/r/16093a0278a6d7d1a0a8bc055c228bed@paul-moore.com

I held off on this so the core charging proposal could settle first, and then refine the LSM side later / in a separate series depending on the feedback.

For v5 I'm adding a capability baseline in mem_cgroup_get_from_fd() following a Sashiko report, so that charging a memcg outside the caller's own subtree requires CAP_SYS_RESOURCE. With that in place the LSM hooks no longer act as the only check, they add finer-grained policy on top of it. Also, unlike the RFC, they are now called from generic memcg code rather than dma-buf code, so I should have renamed them (and plan to) to security_memcg_charge_{task,cgroup}().

Regarding the broader cgroup model, as far as I can tell, existing cgroup control points are kernfs file operations, which SELinux already covers. The only non-file operations taking a cgroup fd (i.e., BPF attach and perf cgroup events) use their own subsystem classes. Since remote charging in this series consumes the target cgroup's resources, checking against the cgroup's label (as patch 7 already does) sounds like a good fit.

So to Sashiko remark and Paul's comment, rather than a dma-buf specific class, would something like a "cgroup" class with a "charge_to" permission for the cgroupfd path, and a process (process2 really) permission for the pidfd path, be an acceptable first step, with the class growing as other non-file control points come up? I'm happy to adjust the naming or structure to what works best.

BR, Albert

-- Sashiko AI review · https://sashiko.dev/#/patchset/20261104-v2_20230123_tjmercier_google_com-v4-...

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] selinux: selinux_dma_buf_charge_cgroup() bypasses check on genfscon cgroups - [Medium] selinux: one-off dma_buf charge_cgroup lacks broader cgroup control design --

commit d0dd0ed1dd84ec5c8f4de9a298a749d83668b53e Author: Albert Esteve aesteve@redhat.com

selinux: Restrict dma-buf direct cgroup charging

This commit implements the selinux_dma_buf_charge_cgroup() hook and adds the charge_cgroup permission to the dma_buf security class to restrict which processes can charge dma-buf memory to a target cgroup.

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8f39d91eabc97..2f99eaa910af4 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2210,6 +2210,40 @@ static int selinux_dma_buf_charge_task(const struct cred *from, const struct cre SECCLASS_DMA_BUF, DMA_BUF__CHARGE_TASK, NULL); } +#ifdef CONFIG_CGROUPS +static int selinux_dma_buf_charge_cgroup(const struct cred *cred, struct cgroup *cgrp) +{

• u32 cgrp_sid, clen;
• int rc;
• char *context;
• rc = kernfs_xattr_get(cgrp->kn, XATTR_NAME_SELINUX, NULL, 0);
• if (rc == -ENODATA)

• return 0;
  

[Severity: High] As reported by Sashiko on v3 [1], in security/selinux/hooks.c, does returning 0 in selinux_dma_buf_charge_cgroup() when kernfs_xattr_get() returns -ENODATA bypass the permission check for all default-labeled cgroups?

When a process calls ioctl(DMA_HEAP_IOCTL_ALLOC) or ioctl(DMA_BUF_IOCTL_XFER_CHARGE) with a charge_fd referencing a cgroup directory, mem_cgroup_get_from_fd() invokes security_dma_buf_charge_cgroup() -> selinux_dma_buf_charge_cgroup().

In SELinux, cgroup and cgroup2 filesystems are configured with SE_SBGENFS | SE_SBGENFS_XATTR in selinux_set_mnt_opts() and obtain their default label (such as cgroup_t) from policy genfscon rules. When a cgroupfs VFS inode is initialized in inode_doinit_with_dentry(), SELinux computes the default SID via selinux_genfs_get_sid() and only uses kernfs xattrs as an optional override:

security/selinux/hooks.c:inode_doinit_with_dentry() { ... rc = selinux_genfs_get_sid(dentry, sclass, sbsec->flags, &sid); if (rc) { dput(dentry); goto out; }

if ((sbsec->flags & SE_SBGENFS_XATTR) && (inode->i_opflags & IOP_XATTR)) { rc = inode_doinit_use_xattr(inode, dentry, sid, &sid); ... }

When no explicit setxattr() has been performed on the cgroup directory, inode_doinit_use_xattr() gets -ENODATA and falls back to def_sid in memory without writing any security.selinux xattr to cgrp->kn:

security/selinux/hooks.c:inode_doinit_use_xattr() { ... if (rc < 0) { kfree(context); if (rc != -ENODATA) { pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%llu\n", __func__, -rc, inode->i_sb->s_id, inode->i_ino); return rc; } *sid = def_sid; return 0; } ... }

Similarly, selinux_kernfs_init_security() sees -ENODATA on the parent node and returns 0 without setting an xattr on child cgroup nodes, and if the cgroup_seclabel policy capability is not enabled, security.selinux xattrs cannot be set on cgroup directories at all.

Because kernfs_xattr_get(cgrp->kn, XATTR_NAME_SELINUX, NULL, 0) returns -ENODATA for every cgroup that has not been manually relabeled via setxattr(), won't selinux_dma_buf_charge_cgroup() skip avc_has_perm() for all default-labeled cgroup_t cgroups and render policy rules like "allow allocator_app_t cgroup_t:dma_buf charge_cgroup;" ineffective?

[ ... ]

diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index b4ebedc6e4240..90d1e04c3d27c 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -181,7 +181,7 @@ const struct security_class_mapping secclass_map[] = { { "user_namespace", { "create", NULL } }, { "memfd_file", { COMMON_FILE_PERMS, "execute_no_trans", "entrypoint", NULL } },

• { "dma_buf", { "charge_task", NULL } },

• { "dma_buf", { "charge_task", "charge_cgroup", NULL } },

[Severity: Medium] As reported by Paul Moore on RFC [2], in security/selinux/include/classmap.h (secclass_map) and security/selinux/hooks.c (selinux_dma_buf_charge_cgroup()), this adds a narrow dma_buf class permission for cgroup charging invoked from DMA_HEAP_IOCTL_ALLOC and DMA_BUF_IOCTL_XFER_CHARGE via mem_cgroup_get_from_fd() -> security_dma_buf_charge_cgroup().

Rather than introducing a one-off dma_buf cgroup charging permission, should this be part of a broader SELinux access control design covering existing cgroup control points so that the object class and permission model is consistent across cgroup operations?

[1] https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-6-78d... [2] https://lore.kernel.org/r/16093a0278a6d7d1a0a8bc055c228bed@paul-moore.com