Sean Christopherson
f9980f56a1
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() ...
commit 5cbf3264bc715e9eb384e2b68601f8c02bb9a61d upstream.
Use follow_pfn() to get the PFN of a PFNMAP VMA instead of assuming that
vma->vm_pgoff holds the base PFN of the VMA. This fixes a bug where
attempting to do VFIO_IOMMU_MAP_DMA on an arbitrary PFNMAP'd region of
memory calculates garbage for the PFN.
Hilariously, this only got detected because the first "PFN" calculated
by vaddr_get_pfn() is PFN 0 (vma->vm_pgoff==0), and iommu_iova_to_phys()
uses PA==0 as an error, which triggers a WARN in vfio_unmap_unpin()
because the translation "failed". PFN 0 is now unconditionally reserved
on x86 in order to mitigate L1TF, which causes is_invalid_reserved_pfn()
to return true and in turns results in vaddr_get_pfn() returning success
for PFN 0. Eventually the bogus calculation runs into PFNs that aren't
reserved and leads to failure in vfio_pin_map_dma(). The subsequent
call to vfio_remove_dma() attempts to unmap PFN 0 and WARNs.
WARNING: CPU: 8 PID: 5130 at drivers/vfio/vfio_iommu_type1.c:750 vfio_unmap_unpin+0x2e1/0x310 [vfio_iommu_type1]
Modules linked in: vfio_pci vfio_virqfd vfio_iommu_type1 vfio ...
CPU: 8 PID: 5130 Comm: sgx Tainted: G W 5.6.0-rc5-705d787c7fee-vfio+ #3
Hardware name: Intel Corporation Mehlow UP Server Platform/Moss Beach Server, BIOS CNLSE2R1.D00.X119.B49.1803010910 03/01/2018
RIP: 0010:vfio_unmap_unpin+0x2e1/0x310 [vfio_iommu_type1]
Code: <0f> 0b 49 81 c5 00 10 00 00 e9 c5 fe ff ff bb 00 10 00 00 e9 3d fe
RSP: 0018:ffffbeb5039ebda8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9a55cbf8d480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff9a52b771c200
RBP: 0000000000000000 R08: 0000000000000040 R09: 00000000fffffff2
R10: 0000000000000001 R11: ffff9a51fa896000 R12: 0000000184010000
R13: 0000000184000000 R14: 0000000000010000 R15: ffff9a55cb66ea08
FS: 00007f15d3830b40(0000) GS:ffff9a55d5600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561cf39429e0 CR3: 000000084f75f005 CR4: 00000000003626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
vfio_remove_dma+0x17/0x70 [vfio_iommu_type1]
vfio_iommu_type1_ioctl+0x9e3/0xa7b [vfio_iommu_type1]
ksys_ioctl+0x92/0xb0
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x4c/0x180
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f15d04c75d7
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
Fixes: 73fa0d10d0
2020-05-05 19:14:39 +02:00
PM: ACPI: Output correct message on target power state
2020-05-05 19:14:36 +02:00
ANDROID: binder: synchronize_rcu() when using POLLFREE.
2019-10-07 18:53:19 +02:00
libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
2020-04-24 07:58:59 +02:00
atm: eni: fix uninitialized variable warning
2020-02-05 13:05:41 +00:00
driver core: platform: fix u32 greater or equal to zero comparison
2020-02-28 15:42:37 +01:00
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-29 10:24:31 +01:00
virtio-blk: fix hw_queue stopped on arbitrary error
2020-03-20 09:07:43 +01:00
Bluetooth: btusb: fix PM leak in error case of setup
2020-01-12 11:24:16 +01:00
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
2020-04-24 07:58:46 +02:00
cdrom: respect device capabilities during opening action
2020-01-04 13:41:02 +01:00
tpm/tpm_tis: Free IRQ if probing fails
2020-05-02 17:23:11 +02:00
clk: tegra: Fix Tegra PMC clock out parents
2020-04-24 07:59:11 +02:00
clocksource/drivers/exynos_mct: Fix error path in timer resources initialization
2020-01-29 10:24:17 +01:00
cpufreq: powernv: Fix use-after-free
2020-04-24 07:58:59 +02:00
cpuidle: Do not unset the driver if it is there already
2019-12-21 10:42:04 +01:00
crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
2020-05-02 17:22:59 +02:00
PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
2020-02-28 15:42:28 +01:00
dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
2020-03-11 07:53:13 +01:00
dma-buf: Fix memory leak in sync_file_merge()
2019-12-21 10:42:32 +01:00
EDAC/ghes: Fix grain calculation
2020-01-04 13:39:51 +01:00
extcon: sm5502: Reset registers during initialization
2020-01-04 13:39:22 +01:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
efi: Add a sanity check to efivar_store_raw()
2020-03-20 09:07:49 +01:00
Revert "gpio: set up initial state from .get_direction()"
2020-04-24 07:59:08 +02:00
drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
2020-05-05 19:14:29 +02:00
HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
2020-03-20 09:07:57 +01:00
hwmon: (jc42) Fix name to have no illegal characters
2020-05-02 17:23:18 +02:00
intel_th: Fix user-visible error codes
2020-04-02 17:20:25 +02:00
i2c: st: fix missing struct parameter description
2020-04-24 07:58:47 +02:00
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-28 15:42:36 +01:00
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
2020-05-02 17:23:09 +02:00
RDMA/mlx4: Initialize ib_spec on the stack
2020-05-05 19:14:39 +02:00
Input: i8042 - add Acer Aspire 5738z to nomux list
2020-04-24 07:58:59 +02:00
iommu/amd: Fix the configuration of GCR3 table root pointer
2020-04-24 07:59:14 +02:00
irqchip/versatile-fpga: Apply clear-mask earlier
2020-04-24 07:58:53 +02:00
staging: gigaset: add endpoint-type sanity check
2019-12-21 10:41:50 +01:00
leds: leds-lp5562 allow firmware files up to the maximum length
2019-10-05 12:30:17 +02:00
macintosh/windfarm_smu_sat: Fix debug output
2019-11-28 18:28:30 +01:00
mailbox: handle failed named mailbox channel request
2019-08-04 09:33:41 +02:00
dm verity fec: fix hash block number in verity_fec_decode
2020-05-05 19:14:38 +02:00
media: ti-vpe: cal: fix disable_irqs to only the intended target
2020-04-24 07:58:52 +02:00
memory: tegra: Fix integer overflow on tick value calculation
2019-05-25 18:26:49 +02:00
memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
2019-10-29 09:15:25 +01:00
scsi: mptfusion: Fix double fetch bug in ioctl
2020-01-23 08:19:39 +01:00
mfd: dln2: Fix sanity checking for endpoints
2020-04-24 07:59:01 +02:00
misc: echo: Remove unnecessary parentheses and simplify check for zero
2020-04-24 07:59:01 +02:00
mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
2020-04-02 17:20:25 +02:00
mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
2020-05-02 17:23:15 +02:00
net/cxgb4: Check the return from t4_query_params properly
2020-05-02 17:23:16 +02:00
NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
2020-04-02 17:20:30 +02:00
ntb: intel: fix return value for ndev_vec_mask()
2019-11-28 18:28:52 +01:00
libnvdimm: Out of bounds read in __nd_ioctl()
2020-04-24 07:59:14 +02:00
nvme: retain split access workaround for capability reads
2020-01-29 10:24:33 +01:00
nvmem: core: return error code instead of NULL from nvmem_device_get
2019-11-25 09:52:16 +01:00
of: unittest: kmemleak in of_unittest_platform_populate()
2020-04-24 07:59:10 +02:00
parisc: Disable HP HSC-PCI Cards to prevent kernel crash
2019-10-05 12:30:31 +02:00
parport: load lowlevel driver if ports not found
2020-01-04 13:39:55 +01:00
PCI/ASPM: Allow re-enabling Clock PM
2020-05-02 17:23:07 +02:00
drivers/perf: arm_pmu: Fix failure path in PM notifier
2019-08-06 18:29:41 +02:00
phy: phy-twl4030-usb: fix denied runtime access
2019-11-25 09:52:50 +01:00
pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
2020-02-28 15:42:28 +01:00
MIPS: Loongson: Fix return value of loongson_hwmon_init
2020-01-29 10:24:35 +01:00
power: supply: bq27xxx_battery: Silence deferred-probe error
2020-04-24 07:59:11 +02:00
x86/cpu: Sanitize FAM6_ATOM naming
2019-05-14 19:19:34 +02:00
drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
2019-08-04 09:33:45 +02:00
pwm: bcm2835: Dynamically allocate base
2020-05-02 17:23:07 +02:00
drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
2020-01-29 10:24:18 +01:00
regulator: rk808: Lower log level on optional GPIOs being not available
2020-02-28 15:42:23 +01:00
remoteproc: Fix wrong rvring index computation
2020-05-02 17:23:14 +02:00
reset: Fix potential use-after-free in __of_reset_control_get()
2019-11-25 09:53:42 +01:00
rtc: pm8xxx: Fix issue in RTC write path
2020-04-24 07:59:09 +02:00
s390/cio: avoid duplicated 'ADD' uevents
2020-05-02 17:23:06 +02:00
scsi: iscsi: Report unbind session event when the target has been removed
2020-05-02 17:23:04 +02:00
soc: qcom: smem: Use le32_to_cpu for comparison
2020-04-24 07:59:10 +02:00
spi/zynqmp: remove entry that causes a cs glitch
2020-04-02 17:20:21 +02:00
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
2019-05-31 06:48:12 -07:00
staging: vt6656: Power save stop wake_up_count wrap around.
2020-05-02 17:23:13 +02:00
scsi: target: fix PR IN / READ FULL STATUS for FC
2020-05-02 17:23:17 +02:00
thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
2020-01-29 10:24:24 +01:00
thunderbolt: Use 32-bit writes when writing ring producer/consumer
2019-11-06 12:18:14 +01:00
tty: rocket, avoid OOB access
2020-05-02 17:23:12 +02:00
uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
2020-02-28 15:42:20 +01:00
usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
2020-05-02 17:23:15 +02:00
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
2020-05-05 19:14:39 +02:00
vhost: Check docket sk_family instead of call getname
2020-03-11 07:53:08 +01:00
fbdev: potential information leak in do_fb_ioctl()
2020-04-24 07:59:14 +02:00
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
2019-05-16 19:43:47 +02:00
virtio-balloon: fix managed page counts when migrating pages between zones
2019-12-21 10:41:57 +01:00
vme: bridges: reduce stack usage
2020-02-28 15:42:33 +01:00
w1: fix the resume command API
2019-05-31 06:48:15 -07:00
watchdog: reset last_hw_keepalive time at start
2020-05-02 17:23:02 +02:00
xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
2020-05-02 17:23:17 +02:00
f9980f56a1