Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'vfio-v5.1-rc4' of git://github.com/awilliam/linux-vfio
Pull VFIO fixes from Alex Williamson:
- Fix clang printk format errors (Louis Taylor)
- Declare structure static to fix sparse warning (Wang Hai)
- Limit user DMA mappings per container (CVE-2019-3882) (Alex
Williamson)
* tag 'vfio-v5.1-rc4' of git://github.com/awilliam/linux-vfio:
vfio/type1: Limit DMA mappings per container
vfio/spapr_tce: Make symbol 'tce_iommu_driver_ops' static
vfio/pci: use correct format characters
+17
-3
+2
-2
drivers/vfio/pci/vfio_pci.c
+2
-2
drivers/vfio/pci/vfio_pci.c
···
1661
1661
rc = pci_add_dynid(&vfio_pci_driver, vendor, device,
1662
1662
subvendor, subdevice, class, class_mask, 0);
1663
1663
if (rc)
1664
-
pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",
1664
+
pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
1665
1665
vendor, device, subvendor, subdevice,
1666
1666
class, class_mask, rc);
1667
1667
else
1668
-
pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",
1668
+
pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
1669
1669
vendor, device, subvendor, subdevice,
1670
1670
class, class_mask);
1671
1671
}
+1
-1
drivers/vfio/vfio_iommu_spapr_tce.c
+1
-1
drivers/vfio/vfio_iommu_spapr_tce.c
···
1398
1398
mutex_unlock(&container->lock);
1399
1399
}
1400
1400
1401
-
const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {
1401
+
static const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {
1402
1402
.name = "iommu-vfio-powerpc",
1403
1403
.owner = THIS_MODULE,
1404
1404
.open = tce_iommu_open,
+14
drivers/vfio/vfio_iommu_type1.c
+14
drivers/vfio/vfio_iommu_type1.c
···
58
58
MODULE_PARM_DESC(disable_hugepages,
59
59
"Disable VFIO IOMMU support for IOMMU hugepages.");
60
60
61
+
static unsigned int dma_entry_limit __read_mostly = U16_MAX;
62
+
module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);
63
+
MODULE_PARM_DESC(dma_entry_limit,
64
+
"Maximum number of user DMA mappings per container (65535).");
65
+
61
66
struct vfio_iommu {
62
67
struct list_head domain_list;
63
68
struct vfio_domain *external_domain; /* domain for external user */
64
69
struct mutex lock;
65
70
struct rb_root dma_list;
66
71
struct blocking_notifier_head notifier;
72
+
unsigned int dma_avail;
67
73
bool v2;
68
74
bool nesting;
69
75
};
···
842
836
vfio_unlink_dma(iommu, dma);
843
837
put_task_struct(dma->task);
844
838
kfree(dma);
839
+
iommu->dma_avail++;
845
840
}
846
841
847
842
static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
···
1088
1081
goto out_unlock;
1089
1082
}
1090
1083
1084
+
if (!iommu->dma_avail) {
1085
+
ret = -ENOSPC;
1086
+
goto out_unlock;
1087
+
}
1088
+
1091
1089
dma = kzalloc(sizeof(*dma), GFP_KERNEL);
1092
1090
if (!dma) {
1093
1091
ret = -ENOMEM;
1094
1092
goto out_unlock;
1095
1093
}
1096
1094
1095
+
iommu->dma_avail--;
1097
1096
dma->iova = iova;
1098
1097
dma->vaddr = vaddr;
1099
1098
dma->prot = prot;
···
1596
1583
1597
1584
INIT_LIST_HEAD(&iommu->domain_list);
1598
1585
iommu->dma_list = RB_ROOT;
1586
+
iommu->dma_avail = dma_entry_limit;
1599
1587
mutex_init(&iommu->lock);
1600
1588
BLOCKING_INIT_NOTIFIER_HEAD(&iommu->notifier);
1601
1589