lkml.org 
[lkml]   [2020]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v3 11/16] vfio/type1: Mark follow_pfn as unsafe
    Date
    The code seems to stuff these pfns into iommu pts (or something like
    that, I didn't follow), but there's no mmu_notifier to ensure that
    access is synchronized with pte updates.

    Hence mark these as unsafe. This means that with
    CONFIG_STRICT_FOLLOW_PFN, these will be rejected.

    Real fix is to wire up an mmu_notifier ... somehow. Probably means any
    invalidate is a fatal fault for this vfio device, but then this
    shouldn't ever happen if userspace is reasonable.

    Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
    Cc: Jason Gunthorpe <jgg@ziepe.ca>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: John Hubbard <jhubbard@nvidia.com>
    Cc: Jérôme Glisse <jglisse@redhat.com>
    Cc: Jan Kara <jack@suse.cz>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: linux-mm@kvack.org
    Cc: linux-arm-kernel@lists.infradead.org
    Cc: linux-samsung-soc@vger.kernel.org
    Cc: linux-media@vger.kernel.org
    Cc: Alex Williamson <alex.williamson@redhat.com>
    Cc: Cornelia Huck <cohuck@redhat.com>
    Cc: kvm@vger.kernel.org
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.com>
    ---
    drivers/vfio/vfio_iommu_type1.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
    index 5fbf0c1f7433..a4d53f3d0a35 100644
    --- a/drivers/vfio/vfio_iommu_type1.c
    +++ b/drivers/vfio/vfio_iommu_type1.c
    @@ -421,7 +421,7 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
    {
    int ret;

    - ret = follow_pfn(vma, vaddr, pfn);
    + ret = unsafe_follow_pfn(vma, vaddr, pfn);
    if (ret) {
    bool unlocked = false;

    @@ -435,7 +435,7 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
    if (ret)
    return ret;

    - ret = follow_pfn(vma, vaddr, pfn);
    + ret = unsafe_follow_pfn(vma, vaddr, pfn);
    }

    return ret;
    --
    2.28.0
    \
     
     \ /
      Last update: 2020-10-21 10:58    [W:4.056 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site