android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vfio/type1: prevent underflow of locked_vm via exec()

Browse Source 
commit 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026 upstream.

When a vfio container is preserved across exec, the task does not change,
but it gets a new mm with locked_vm=0, and loses the count from existing
dma mappings.  If the user later unmaps a dma mapping, locked_vm underflows
to a large unsigned value, and a subsequent dma map request fails with
ENOMEM in __account_locked_vm.

To avoid underflow, grab and save the mm at the time a dma is mapped.
Use that mm when adjusting locked_vm, rather than re-acquiring the saved
task's mm, which may have changed.  If the saved mm is dead, do nothing.

locked_vm is incremented for existing mappings in a subsequent patch.

Fixes: 73fa0d10d0 ("vfio: Type1 IOMMU implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/1675184289-267876-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Steve Sistare 2023-01-31 08:58:04 -08:00 committed by Greg Kroah-Hartman
parent 691a8e26de
commit 5a27124271
1 changed files with 14 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
drivers/vfio/vfio_iommu_type1.c
View File

@ -96,6 +96,7 @@ struct vfio_dma {
struct task_struct *task; struct task_struct *task;
struct rb_root pfn_list; /* Ex-user pinned pfn list */ struct rb_root pfn_list; /* Ex-user pinned pfn list */
unsigned long *bitmap; unsigned long *bitmap;
struct mm_struct *mm;
}; };
struct vfio_batch { struct vfio_batch {
@ -391,8 +392,8 @@ static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async)
if (!npage) if (!npage)
return 0; return 0;
mm = async ? get_task_mm(dma->task) : dma->task->mm; mm = dma->mm;
if (!mm) if (async && !mmget_not_zero(mm))
return -ESRCH; /* process exited */ return -ESRCH; /* process exited */
ret = mmap_write_lock_killable(mm); ret = mmap_write_lock_killable(mm);
@ -666,8 +667,8 @@ static int vfio_pin_page_external(struct vfio_dma *dma, unsigned long vaddr,
struct mm_struct *mm; struct mm_struct *mm;
int ret; int ret;
mm = get_task_mm(dma->task); mm = dma->mm;
if (!mm) if (!mmget_not_zero(mm))
return -ENODEV; return -ENODEV;
ret = vaddr_get_pfns(mm, vaddr, 1, dma->prot, pfn_base, pages); ret = vaddr_get_pfns(mm, vaddr, 1, dma->prot, pfn_base, pages);
@ -677,7 +678,7 @@ static int vfio_pin_page_external(struct vfio_dma *dma, unsigned long vaddr,
ret = 0; ret = 0;
if (do_accounting && !is_invalid_reserved_pfn(*pfn_base)) { if (do_accounting && !is_invalid_reserved_pfn(*pfn_base)) {
ret = vfio_lock_acct(dma, 1, true); ret = vfio_lock_acct(dma, 1, false);
if (ret) { if (ret) {
put_pfn(*pfn_base, dma->prot); put_pfn(*pfn_base, dma->prot);
if (ret == -ENOMEM) if (ret == -ENOMEM)
@ -1031,6 +1032,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
vfio_unmap_unpin(iommu, dma, true); vfio_unmap_unpin(iommu, dma, true);
vfio_unlink_dma(iommu, dma); vfio_unlink_dma(iommu, dma);
put_task_struct(dma->task); put_task_struct(dma->task);
mmdrop(dma->mm);
vfio_dma_bitmap_free(dma); vfio_dma_bitmap_free(dma);
kfree(dma); kfree(dma);
iommu->dma_avail++; iommu->dma_avail++;
@ -1452,29 +1454,15 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
* against the locked memory limit and we need to be able to do both * against the locked memory limit and we need to be able to do both
* outside of this call path as pinning can be asynchronous via the * outside of this call path as pinning can be asynchronous via the
* external interfaces for mdev devices. RLIMIT_MEMLOCK requires a * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a
* task_struct and VM locked pages requires an mm_struct, however * task_struct. Save the group_leader so that all DMA tracking uses
* holding an indefinite mm reference is not recommended, therefore we * the same task, to make debugging easier. VM locked pages requires
* only hold a reference to a task. We could hold a reference to * an mm_struct, so grab the mm in case the task dies.
* current, however QEMU uses this call path through vCPU threads,
* which can be killed resulting in a NULL mm and failure in the unmap
* path when called via a different thread. Avoid this problem by
* using the group_leader as threads within the same group require
* both CLONE_THREAD and CLONE_VM and will therefore use the same
* mm_struct.
*
* Previously we also used the task for testing CAP_IPC_LOCK at the
* time of pinning and accounting, however has_capability() makes use
* of real_cred, a copy-on-write field, so we can't guarantee that it
* matches group_leader, or in fact that it might not change by the
* time it's evaluated. If a process were to call MAP_DMA with
* CAP_IPC_LOCK but later drop it, it doesn't make sense that they
* possibly see different results for an iommu_mapped vfio_dma vs
* externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the
* time of calling MAP_DMA.
*/ */
get_task_struct(current->group_leader); get_task_struct(current->group_leader);
dma->task = current->group_leader; dma->task = current->group_leader;
dma->lock_cap = capable(CAP_IPC_LOCK); dma->lock_cap = capable(CAP_IPC_LOCK);
dma->mm = current->mm;
mmgrab(dma->mm);
dma->pfn_list = RB_ROOT; dma->pfn_list = RB_ROOT;
@ -2998,9 +2986,8 @@ static int vfio_iommu_type1_dma_rw_chunk(struct vfio_iommu *iommu,
!(dma->prot & IOMMU_READ)) !(dma->prot & IOMMU_READ))
return -EPERM; return -EPERM;
mm = get_task_mm(dma->task); mm = dma->mm;
if (!mmget_not_zero(mm))
if (!mm)
return -EPERM; return -EPERM;
if (kthread) if (kthread)