Alex Williamson
4f97abd571
vfio/type1: Limit DMA mappings per container ...
commit 492855939bdb59c6f947b0b5b44af9ad82b7e38c upstream.
Memory backed DMA mappings are accounted against a user's locked
memory limit, including multiple mappings of the same memory. This
accounting bounds the number of such mappings that a user can create.
However, DMA mappings that are not backed by memory, such as DMA
mappings of device MMIO via mmaps, do not make use of page pinning
and therefore do not count against the user's locked memory limit.
These mappings still consume memory, but the memory is not well
associated to the process for the purpose of oom killing a task.
To add bounding on this use case, we introduce a limit to the total
number of concurrent DMA mappings that a user is allowed to create.
This limit is exposed as a tunable module option where the default
value of 64K is expected to be well in excess of any reasonable use
case (a large virtual machine configuration would typically only make
use of tens of concurrent mappings).
This fixes CVE-2019-3882.
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
[groeck: Adjust for missing upstream commit]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-04 08:49:10 +02:00
ACPI / SBS: Fix GPE storm on recent MacBookPro's
2019-04-20 09:07:52 +02:00
ARM: amba: Don't read past the end of sysfs "driver_override" buffer
2018-05-01 15:13:08 -07:00
binder: fix proc->files use-after-free
2018-12-08 13:05:07 +01:00
libata: fix using DMA buffers on stack
2019-05-04 08:49:09 +02:00
atm: he: fix sign-extension overflow on large shift
2019-02-27 10:06:59 +01:00
PM / wakeup: Rework wakeup source timer cancellation
2019-03-23 13:19:53 +01:00
Revert "block/loop: Use global lock for ioctl() operation."
2019-05-02 09:32:04 +02:00
Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"
2018-11-27 16:09:40 +01:00
bus: arm-cci: remove unnecessary unreachable()
2018-12-05 19:42:41 +01:00
cdrom: Fix race condition in cdrom_sysctl_register
2019-04-05 22:29:12 +02:00
tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
2019-04-27 09:34:41 +02:00
clk: ingenic: Fix doc of ingenic_cgu_div_info
2019-03-23 13:19:49 +01:00
clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
2019-03-23 13:19:46 +01:00
cpufreq: pxa2xx: remove incorrect __init annotation
2019-03-23 13:19:48 +01:00
cpuidle: big.LITTLE: fix refcount leak
2019-02-12 19:44:55 +01:00
crypto: crypto4xx - properly set IV after de- and encrypt
2019-04-27 09:34:41 +02:00
PM / devfreq: Fix potential NULL pointer dereference in governor_store
2018-04-13 19:48:09 +02:00
dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
2019-05-02 09:32:02 +02:00
dma-buf: remove redundant initialization of sg_table
2018-06-06 16:44:33 +02:00
EDAC, skx_edac: Fix logical channel intermediate decoding
2018-11-13 11:16:56 -08:00
firewire-ohci: work around oversized DMA reads on JMicron controllers
2018-05-30 07:50:18 +02:00
efi/memattr: Don't bail on zero VA if it equals the region's PA
2019-04-05 22:29:12 +02:00
gpio: of: Fix of_gpiochip_add() error path
2019-05-04 08:49:09 +02:00
drm/vc4: Fix compilation error reported by kbuild test bot
2019-05-02 09:32:02 +02:00
i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
2019-04-27 09:34:47 +02:00
HSI: ssi_protocol: double free in ssip_pn_xmit()
2018-03-24 11:00:12 +01:00
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
2018-12-29 13:40:15 +01:00
hwmon: (lm80) Fix missing unlock on error in set_fan_div()
2019-02-23 09:05:58 +01:00
intel_th: gth: Fix an off-by-one in output unassigning
2019-05-02 09:32:03 +02:00
i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
2019-04-05 22:29:05 +02:00
ide: pmac: add of_node_put()
2018-12-21 14:11:37 +01:00
io: accel: kxcjk1013: restore the range after resume.
2019-04-27 09:34:42 +02:00
IB/rdmavt: Fix frwr memory registration
2019-05-02 09:32:00 +02:00
Input: synaptics-rmi4 - write config register values to the right offset
2019-05-02 09:32:02 +02:00
iommu/dmar: Fix buffer overflow during PCI bus notification
2019-04-20 09:07:53 +02:00
irqchip/mbigen: Don't clear eventid when freeing an MSI
2019-04-20 09:07:49 +02:00
mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
2019-04-03 06:24:14 +02:00
leds: pca9532: fix a potential NULL pointer dereference
2019-05-04 08:49:10 +02:00
macintosh/rack-meter: Convert cputime64_t use to u64
2018-10-20 09:51:32 +02:00
mailbox: xgene-slimpro: Fix potential NULL pointer dereference
2018-09-09 20:01:19 +02:00
bcache: improve sysfs_strtoul_clamp()
2019-04-05 22:29:12 +02:00
media: vivid: check if the cec_adapter is valid
2019-05-04 08:49:06 +02:00
memory: tegra: Apply interrupts mask per SoC
2018-08-03 07:55:24 +02:00
memstick: Prevent memstick host from getting runtime suspended during card detection
2019-02-12 19:44:55 +01:00
scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-05-25 16:13:06 +02:00
mfd: mc13xxx: Fix a missing check of a register-read failure
2019-02-27 10:06:59 +01:00
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
mmc: sdhci: Fix data command CRC error handling
2019-04-27 09:34:41 +02:00
mtd: rawnand: gpmi: fix MX28 bus master lockup problem
2019-02-15 08:07:37 +01:00
net: ethernet: ti: fix possible object reference leak
2019-05-04 08:49:09 +02:00
NFC: nxp-nci: Include unaligned.h instead of access_ok.h
2019-01-09 16:16:39 +01:00
ntb_transport: Fix bug with max_mw_size parameter
2018-05-30 07:50:22 +02:00
libnvdimm: Fix altmap reservation size calculation
2019-03-23 13:19:45 +01:00
nvmet-rdma: fix null dereference under heavy load
2019-01-31 08:12:37 +01:00
nvmem: properly handle returned value nvmem_reg_read
2018-08-03 07:55:22 +02:00
of: add helper to lookup compatible child node
2018-12-01 09:44:21 +01:00
parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
2018-05-30 07:50:43 +02:00
parport_pc: fix find_superio io compare code, should use equal test.
2019-03-23 13:19:50 +01:00
PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
2019-04-17 08:36:47 +02:00
pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
2018-11-13 11:16:46 -08:00
drivers/perf: arm_pmu: handle no platform_device
2018-03-22 09:17:51 +01:00
phy: tegra: remove redundant self assignment of 'map'
2019-02-27 10:07:03 +01:00
pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
2019-03-23 13:19:43 +01:00
platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
2019-03-13 14:04:57 -07:00
power: supply: charger-manager: Fix incorrect return value
2019-03-27 14:13:05 +09:00
PowerCap: Fix an error code in powercap_register_zone()
2018-04-13 19:47:56 +02:00
ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
2019-02-12 19:44:52 +01:00
pwm: tiehrpwm: Fix disabling of output of PWMs
2018-09-09 20:01:25 +02:00
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
2019-04-05 22:29:14 +02:00
reset: make device_reset_optional() really optional
2018-12-08 13:05:08 +01:00
rpmsg: smd: fix memory leak on channel create
2018-11-13 11:17:03 -08:00
rtc: Fix overflow when converting time64_t to rtc_time
2019-03-27 14:13:04 +09:00
scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN
2019-05-04 08:49:09 +02:00
drivers/sbus/char: add of_node_put()
2018-12-21 14:11:36 +01:00
scsi: qla4xxx: fix a potential NULL pointer dereference
2019-05-04 08:49:09 +02:00
soc/tegra: pmc: Drop locking from tegra_powergate_is_powered()
2019-04-20 09:07:53 +02:00
spi: pxa2xx: Setup maximum supported DMA transfer length
2019-03-23 13:19:46 +01:00
staging: rtl8712: uninitialized memory in read_bbreg_hdl()
2019-05-04 08:49:08 +02:00
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
2019-03-23 13:19:47 +01:00
TC: Set DMA masks for devices
2018-11-13 11:17:02 -08:00
thermal/int340x_thermal: fix mode setting
2019-04-20 09:07:48 +02:00
thunderbolt: Resume control channel after hibernation image is created
2018-04-24 09:34:12 +02:00
serial: ar933x_uart: Fix build failure with disabled console
2019-05-04 08:49:07 +02:00
uio: Fix an Oops on load
2018-11-27 16:09:41 +01:00
usb: u132-hcd: fix resource leak
2019-05-04 08:49:09 +02:00
uwb: hwa-rc: fix memory leak at probe
2018-10-03 17:01:42 -07:00
vfio/type1: Limit DMA mappings per container
2019-05-04 08:49:10 +02:00
vhost: reject zero size iova range
2019-04-27 09:34:40 +02:00
fbdev: fbmem: fix memory access if logo is bigger than the screen
2019-04-05 22:29:12 +02:00
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
2019-04-17 08:36:47 +02:00
w1: omap-hdq: fix missing bus unregister at removal
2018-11-13 11:17:01 -08:00
watchdog: sbsa: use 32-bit read for WCV
2018-05-30 07:50:34 +02:00
xen: xlate_mmu: add missing header to fix 'W=1' warning
2018-12-17 09:38:34 +01:00
zorro: Set up z->dev.dma_mask for the DMA API
2018-05-30 07:50:44 +02:00
4f97abd571