Patch "vfio/type1: check pfn valid before converting to struct page" has been added to the 6.3-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    vfio/type1: check pfn valid before converting to struct page

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vfio-type1-check-pfn-valid-before-converting-to-stru.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 75822bfcece8d5b2a9eb942afc1213b987882174
Author: Yan Zhao <yan.y.zhao@xxxxxxxxx>
Date:   Fri May 19 14:58:43 2023 +0800

    vfio/type1: check pfn valid before converting to struct page
    
    [ Upstream commit 4752354af71043e6fd72ef5490ed6da39e6cab4a ]
    
    Check physical PFN is valid before converting the PFN to a struct page
    pointer to be returned to caller of vfio_pin_pages().
    
    vfio_pin_pages() pins user pages with contiguous IOVA.
    If the IOVA of a user page to be pinned belongs to vma of vm_flags
    VM_PFNMAP, pin_user_pages_remote() will return -EFAULT without returning
    struct page address for this PFN. This is because usually this kind of PFN
    (e.g. MMIO PFN) has no valid struct page address associated.
    Upon this error, vaddr_get_pfns() will obtain the physical PFN directly.
    
    While previously vfio_pin_pages() returns to caller PFN arrays directly,
    after commit
    34a255e67615 ("vfio: Replace phys_pfn with pages for vfio_pin_pages()"),
    PFNs will be converted to "struct page *" unconditionally and therefore
    the returned "struct page *" array may contain invalid struct page
    addresses.
    
    Given current in-tree users of vfio_pin_pages() only expect "struct page *
    returned, check PFN validity and return -EINVAL to let the caller be
    aware of IOVAs to be pinned containing PFN not able to be returned in
    "struct page *" array. So that, the caller will not consume the returned
    pointer (e.g. test PageReserved()) and avoid error like "supervisor read
    access in kernel mode".
    
    Fixes: 34a255e67615 ("vfio: Replace phys_pfn with pages for vfio_pin_pages()")
    Cc: Sean Christopherson <seanjc@xxxxxxxxxx>
    Reviewed-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
    Signed-off-by: Yan Zhao <yan.y.zhao@xxxxxxxxx>
    Reviewed-by: Sean Christopherson <seanjc@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230519065843.10653-1-yan.y.zhao@xxxxxxxxx
    Signed-off-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 493c31de0edb9..0620dbe5cca0c 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -860,6 +860,11 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
 		if (ret)
 			goto pin_unwind;
 
+		if (!pfn_valid(phys_pfn)) {
+			ret = -EINVAL;
+			goto pin_unwind;
+		}
+
 		ret = vfio_add_to_pfn_list(dma, iova, phys_pfn);
 		if (ret) {
 			if (put_pfn(phys_pfn, dma->prot) && do_accounting)



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux