# git rev-parse -q --verify d99d49613b7cd196ea161fc708040ea88adb6e18^{commit} d99d49613b7cd196ea161fc708040ea88adb6e18 already have revision, skipping fetch # git checkout -q -f -B kisskb d99d49613b7cd196ea161fc708040ea88adb6e18 # git clean -qxdf # < git log -1 # commit d99d49613b7cd196ea161fc708040ea88adb6e18 # Author: Alexey Kardashevskiy # Date: Wed Jul 4 15:00:52 2018 +1000 # # KVM: PPC: Check if IOMMU page is contained in the pinned physical page # # A VM which has: # - a DMA capable device passed through to it (eg. network card); # - running a malicious kernel that ignores H_PUT_TCE failure; # - capability of using IOMMU pages bigger that physical pages # can create an IOMMU mapping that exposes (for example) 16MB of # the host physical memory to the device when only 64K was allocated to the VM. # # The remaining 16MB - 64K will be some other content of host memory, possibly # including pages of the VM, but also pages of host kernel memory, host # programs or other VMs. # # The attacking VM does not control the location of the page it can map, # and is only allowed to map as many pages as it has pages of RAM. # # We already have a check in drivers/vfio/vfio_iommu_spapr_tce.c that # an IOMMU page is contained in the physical page so the PCI hardware won't # get access to unassigned host memory; however this check is missing in # the KVM fastpath (H_PUT_TCE accelerated code). We were lucky so far and # did not hit this yet as the very first time when the mapping happens # we do not have tbl::it_userspace allocated yet and fall back to # the userspace which in turn calls VFIO IOMMU driver, this fails and # the guest does not retry, # # This stores the smallest preregistered page size in the preregistered # region descriptor and changes the mm_iommu_xxx API to check this against # the IOMMU page size. This only allows huge pages use if the entire # preregistered block is backed with huge pages which are completely # contained the preregistered chunk; otherwise this defaults to PAGE_SIZE. # # Signed-off-by: Alexey Kardashevskiy # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-gcc --version # < git log --format=%s --max-count=1 d99d49613b7cd196ea161fc708040ea88adb6e18 # < make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- randconfig KCONFIG_SEED=0xF29305AE # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_CPU_BIG_ENDIAN=y # Added to kconfig CONFIG_PPC64=y # Added to kconfig CONFIG_PPC_DISABLE_WERROR=y # Added to kconfig CONFIG_SECTION_MISMATCH_WARN_ONLY=y # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # Added to kconfig CONFIG_CC_STACKPROTECTOR_STRONG=n # Added to kconfig CONFIG_GCC_PLUGINS=n # Added to kconfig CONFIG_LD_HEAD_STUB_CATCH=y # Added to kconfig # yes \n | make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- oldconfig yes: standard output: Broken pipe yes: write error # make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- /kisskb/src/net/Makefile:24: CC cannot link executables. Skipping bpfilter. /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:183:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/ipc/shm.c: In function 'ksys_shmdt': /kisskb/src/ipc/shm.c:1648:59: warning: 'file' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c: In function 'proc_reg_open': /kisskb/src/include/linux/list.h:65:12: warning: 'pdeo' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c:339:21: note: 'pdeo' was declared here /kisskb/src/net/Makefile:24: CC cannot link executables. Skipping bpfilter. /kisskb/src/lib/mpi/mpicoder.c: In function 'mpi_read_raw_from_sgl': /kisskb/src/lib/mpi/mpicoder.c:352:8: warning: 'buff' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/udf/unicode.c: In function 'udf_name_conv_char': /kisskb/src/fs/udf/unicode.c:132:8: warning: 'c' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/dma-buf/reservation.c: In function 'reservation_object_add_shared_fence': /kisskb/src/drivers/dma-buf/reservation.c:210:7: warning: 'k' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/dma-buf/reservation.c:160:17: note: 'k' was declared here /kisskb/src/lib/rhashtable.c: In function 'rht_deferred_worker': /kisskb/src/lib/rhashtable.c:269:2: warning: 'next' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/lib/rhashtable.c:234:28: note: 'next' was declared here /kisskb/src/drivers/char/tpm/tpm-sysfs.c: In function 'pubek_show': /kisskb/src/drivers/char/tpm/tpm-sysfs.c:56:5: warning: 'tpm_buf.data' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/char/tpm/tpm2-cmd.c: In function 'tpm2_unseal_trusted': /kisskb/src/drivers/char/tpm/tpm.h:502:9: warning: 'blob_handle' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/char/tpm/tpm2-cmd.c:719:6: note: 'blob_handle' was declared here /kisskb/src/net/core/gen_stats.c: In function '__gnet_stats_copy_basic': /kisskb/src/net/core/gen_stats.c:149:19: warning: 'seq' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/core/flow_dissector.c: In function '__skb_flow_dissect': /kisskb/src/net/core/flow_dissector.c:789:7: warning: 'vlan' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/mfd/tc3589x.c: In function 'tc3589x_probe': /kisskb/src/drivers/mfd/tc3589x.c:390:2: warning: 'version' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/mfd/arizona-core.c: In function 'arizona_dev_init': /kisskb/src/drivers/mfd/arizona-core.c:1404:6: warning: 'n_subdevs' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/core/dev.c: In function 'validate_xmit_skb_list': /kisskb/src/net/core/dev.c:3161:15: warning: 'tail' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/core/rtnetlink.c: In function 'rtnl_newlink': /kisskb/src/net/core/rtnetlink.c:3099:1: warning: the frame size of 1232 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/drivers/iio/temperature/mlx90632.c: In function 'mlx90632_read_raw': /kisskb/src/drivers/iio/temperature/mlx90632.c:348:37: warning: 'object_old_raw' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/iio/temperature/mlx90632.c:429:56: note: 'object_old_raw' was declared here /kisskb/src/drivers/iio/temperature/mlx90632.c:348:37: warning: 'object_new_raw' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/iio/temperature/mlx90632.c:429:40: note: 'object_new_raw' was declared here /kisskb/src/drivers/scsi/aacraid/src.c: In function 'aac_src_intr_message': /kisskb/src/drivers/scsi/aacraid/src.c:98:4: warning: 'bellbits' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/mac80211/mlme.c: In function 'ieee80211_rx_mgmt_beacon': /kisskb/src/net/mac80211/mlme.c:1350:6: warning: 'pwr_level_cisco' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/mac80211/mlme.c:1310:6: note: 'pwr_level_cisco' was declared here /kisskb/src/drivers/target/target_core_user.c: In function 'scatter_data_area': /kisskb/src/drivers/target/target_core_user.c:573:29: warning: 'dbi' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/target/target_core_user.c:587:9: note: 'dbi' was declared here /kisskb/src/drivers/usb/misc/usbtest.c: In function 'test_queue': /kisskb/src/drivers/usb/misc/usbtest.c:2126:1: warning: the frame size of 1216 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/drivers/net/wireless/broadcom/b43/phy_n.c: In function 'b43_nphy_rf_ctl_override_rev7': /kisskb/src/drivers/net/wireless/broadcom/b43/phy_n.c:202:21: warning: 'val_addr' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/wireless/intel/iwlegacy/4965-mac.c: In function 'il4965_tx_skb': /kisskb/src/drivers/net/wireless/intel/iwlegacy/4965-mac.c:1859:33: warning: 'phys_addr' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/ethernet/realtek/r8169.c: In function 'rtl_set_coalesce': /kisskb/src/drivers/net/ethernet/realtek/r8169.c:2401:13: warning: 'cp01' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/ethernet/sfc/farch.c: In function 'efx_farch_filter_rfs_expire_one': /kisskb/src/drivers/net/ethernet/sfc/farch.c:2937:35: warning: 'arfs_id' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/scsi/am53c974.c: In function 'pci_esp_dma_drain': /kisskb/src/drivers/scsi/am53c974.c:199:5: warning: 'resid' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/scsi/hpsa.c: In function 'complete_scsi_command': /kisskb/src/drivers/scsi/hpsa.c:2650:7: warning: 'sense_key' may be used uninitialized in this function [-Wuninitialized] /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-ld: drivers/misc/lkdtm/lkdtm.o: .opd is not a regular array of opd entries Completed OK # rm -rf /kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc # Build took: 0:01:02.805007