linux-stable.git/drivers/vfio, branch v3.16.78

vfio/type1: Limit DMA mappings per container

2019-05-02T20:42:03+00:00

commit 492855939bdb59c6f947b0b5b44af9ad82b7e38c upstream.

Memory backed DMA mappings are accounted against a user's locked
memory limit, including multiple mappings of the same memory.  This
accounting bounds the number of such mappings that a user can create.
However, DMA mappings that are not backed by memory, such as DMA
mappings of device MMIO via mmaps, do not make use of page pinning
and therefore do not count against the user's locked memory limit.
These mappings still consume memory, but the memory is not well
associated to the process for the purpose of oom killing a task.

To add bounding on this use case, we introduce a limit to the total
number of concurrent DMA mappings that a user is allowed to create.
This limit is exposed as a tunable module option where the default
value of 64K is expected to be well in excess of any reasonable use
case (a large virtual machine configuration would typically only make
use of tens of concurrent mappings).

This fixes CVE-2019-3882.

Reviewed-by: Eric Auger 
Tested-by: Eric Auger 
Reviewed-by: Peter Xu 
Reviewed-by: Cornelia Huck 
Signed-off-by: Alex Williamson 
[bwh: Backported to 3.16:
 - Add the out_unlock label in vfio_dma_do_map()
 - Adjust context]
Signed-off-by: Ben Hutchings

vfio: New external user group/file match

2017-10-12T14:27:55+00:00

commit 5d6dee80a1e94cc284d03e06d930e60e8d3ecf7d upstream.

At the point where the kvm-vfio pseudo device wants to release its
vfio group reference, we can't always acquire a new reference to make
that happen.  The group can be in a state where we wouldn't allow a
new reference to be added.  This new helper function allows a caller
to match a file to a group to facilitate this.  Given a file and
group, report if they match.  Thus the caller needs to already have a
group reference to match to the file.  This allows the deletion of a
group without acquiring a new reference.

Signed-off-by: Alex Williamson 
Reviewed-by: Eric Auger 
Reviewed-by: Paolo Bonzini 
Tested-by: Eric Auger 
Signed-off-by: Ben Hutchings

vfio: Fix group release deadlock

2017-10-12T14:27:55+00:00

commit 811642d8d8a82c0cce8dc2debfdaf23c5a144839 upstream.

If vfio_iommu_group_notifier() acquires a group reference and that
reference becomes the last reference to the group, then vfio_group_put
introduces a deadlock code path where we're trying to unregister from
the iommu notifier chain from within a callout of that chain.  Use a
work_struct to release this reference asynchronously.

Signed-off-by: Alex Williamson 
Reviewed-by: Eric Auger 
Tested-by: Eric Auger 
Signed-off-by: Ben Hutchings

vfio/type1: Remove locked page accounting workqueue

2017-08-26T01:14:31+00:00

commit 0cfef2b7410b64d7a430947e0b533314c4f97153 upstream.

If the mmap_sem is contented then the vfio type1 IOMMU backend will
defer locked page accounting updates to a workqueue task.  This has a
few problems and depending on which side the user tries to play, they
might be over-penalized for unmaps that haven't yet been accounted or
race the workqueue to enter more mappings than they're allowed.  The
original intent of this workqueue mechanism seems to be focused on
reducing latency through the ioctl, but we cannot do so at the cost
of correctness.  Remove this workqueue mechanism and update the
callers to allow for failure.  We can also now recheck the limit under
write lock to make sure we don't exceed it.

vfio_pin_pages_remote() also now necessarily includes an unwind path
which we can jump to directly if the consecutive page pinning finds
that we're exceeding the user's memory limits.  This avoids the
current lazy approach which does accounting and mapping up to the
fault, only to return an error on the next iteration to unwind the
entire vfio_dma.

Reviewed-by: Peter Xu 
Reviewed-by: Kirti Wankhede 
Signed-off-by: Alex Williamson 
[bwh: Backported to 3.16:
 - vfio_lock_acct() always operates on current->mm
 - Drop changes to vfio_{,un}pin_page_external() and
   vfio_iommu_unmap_unpin_reaccount()
 - Drop test of rsvd flag
 - Fix up the disable_hugepages case in vfio_pin_pages()
 - Use down_write() instead of down_write_killable()
 - Adjust context]
Signed-off-by: Ben Hutchings

vfio/pci: Fix integer overflows, bitmask check

2016-11-20T01:17:37+00:00

commit 05692d7005a364add85c6e25a6c4447ce08f913a upstream.

The VFIO_DEVICE_SET_IRQS ioctl did not sufficiently sanitize
user-supplied integers, potentially allowing memory corruption. This
patch adds appropriate integer overflow checks, checks the range bounds
for VFIO_IRQ_SET_DATA_NONE, and also verifies that only single element
in the VFIO_IRQ_SET_DATA_TYPE_MASK bitmask is set.
VFIO_IRQ_SET_ACTION_TYPE_MASK is already correctly checked later in
vfio_pci_set_irqs_ioctl().

Furthermore, a kzalloc is changed to a kcalloc because the use of a
kzalloc with an integer multiplication allowed an integer overflow
condition to be reached without this patch. kcalloc checks for overflow
and should prevent a similar occurrence.

Signed-off-by: Vlad Tsyrklevich 
Signed-off-by: Alex Williamson 
Signed-off-by: Ben Hutchings

vfio/pci: Fix NULL pointer oops in error interrupt setup handling

2016-11-20T01:17:06+00:00

commit c8952a707556e04374d7b2fdb3a079d63ddf6f2f upstream.

There are multiple cases in vfio_pci_set_ctx_trigger_single() where
we assume we can safely read from our data pointer without actually
checking whether the user has passed any data via the count field.
VFIO_IRQ_SET_DATA_NONE in particular is entirely broken since we
attempt to pull an int32_t file descriptor out before even checking
the data type.  The other data types assume the data pointer contains
one element of their type as well.

In part this is good news because we were previously restricted from
doing much sanitization of parameters because it was missed in the
past and we didn't want to break existing users.  Clearly DATA_NONE
is completely broken, so it must not have any users and we can fix
it up completely.  For DATA_BOOL and DATA_EVENTFD, we'll just
protect ourselves, returning error when count is zero since we
previously would have oopsed.

Signed-off-by: Alex Williamson 
Reported-by: Chris Thompson 
Reviewed-by: Eric Auger 
[bwh: Backported to 3.16:
 - Drop changes to vfio_pci_set_req_trigger()
 - Apply remaining changes in vfio_pci_set_err_trigger()]
Signed-off-by: Ben Hutchings

vfio: fix ioctl error handling

2016-03-24T10:00:54+00:00

commit 8160c4e455820d5008a1116d2dca35f0363bb062 upstream.

Calling return copy_to_user(...) in an ioctl will not
do the right thing if there's a pagefault:
copy_to_user returns the number of bytes not copied
in this case.

Fix up vfio to do
	return copy_to_user(...)) ?
		-EFAULT : 0;

everywhere.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Alex Williamson 
[ luis: backported to 3.16:
  - dropped changes to vfio_platform_common.c ]
Signed-off-by: Luis Henriques

vfio-pci: Fix the check on pci device type in vfio_pci_probe()

2015-01-16T14:34:28+00:00

commit 7c2e211f3c95b91912a92a8c6736343690042e2e upstream.

Current vfio-pci just supports normal pci device, so vfio_pci_probe() will
return if the pci device is not a normal device. While current code makes a
mistake. PCI_HEADER_TYPE is the offset in configuration space of the device
type, but we use this value to mask the type value.

This patch fixs this by do the check directly on the pci_dev->hdr_type.

Signed-off-by: Wei Yang 
Signed-off-by: Alex Williamson 
Signed-off-by: Luis Henriques

Merge tag 'vfio-v3.16-rc1' of git://github.com/awilliam/linux-vfio into next

2014-06-08T03:12:15+00:00

Pull VFIO updates from Alex Williamson:
 "A handful of VFIO bug fixes for v3.16"

* tag 'vfio-v3.16-rc1' of git://github.com/awilliam/linux-vfio:
  drivers/vfio/pci: Fix wrong MSI interrupt count
  drivers/vfio: Rework offsetofend()
  vfio/iommu_type1: Avoid overflow
  vfio/pci: Fix unchecked return value
  vfio/pci: Fix sizing of DPA and THP express capabilities

drivers/vfio/pci: Fix wrong MSI interrupt count

2014-05-30T17:35:54+00:00

According PCI local bus specification, the register of Message
Control for MSI (offset: 2, length: 2) has bit#0 to enable or
disable MSI logic and it shouldn't be part contributing to the
calculation of MSI interrupt count. The patch fixes the issue.

Signed-off-by: Gavin Shan 
Signed-off-by: Alex Williamson