# git rev-parse -q --verify 76fa4975f3ed12d15762bc979ca44078598ed8ee^{commit} 76fa4975f3ed12d15762bc979ca44078598ed8ee already have revision, skipping fetch # git checkout -q -f -B kisskb 76fa4975f3ed12d15762bc979ca44078598ed8ee # git clean -qxdf # < git log -1 # commit 76fa4975f3ed12d15762bc979ca44078598ed8ee # Author: Alexey Kardashevskiy # Date: Tue Jul 17 17:19:13 2018 +1000 # # KVM: PPC: Check if IOMMU page is contained in the pinned physical page # # A VM which has: # - a DMA capable device passed through to it (eg. network card); # - running a malicious kernel that ignores H_PUT_TCE failure; # - capability of using IOMMU pages bigger that physical pages # can create an IOMMU mapping that exposes (for example) 16MB of # the host physical memory to the device when only 64K was allocated to the VM. # # The remaining 16MB - 64K will be some other content of host memory, possibly # including pages of the VM, but also pages of host kernel memory, host # programs or other VMs. # # The attacking VM does not control the location of the page it can map, # and is only allowed to map as many pages as it has pages of RAM. # # We already have a check in drivers/vfio/vfio_iommu_spapr_tce.c that # an IOMMU page is contained in the physical page so the PCI hardware won't # get access to unassigned host memory; however this check is missing in # the KVM fastpath (H_PUT_TCE accelerated code). We were lucky so far and # did not hit this yet as the very first time when the mapping happens # we do not have tbl::it_userspace allocated yet and fall back to # the userspace which in turn calls VFIO IOMMU driver, this fails and # the guest does not retry, # # This stores the smallest preregistered page size in the preregistered # region descriptor and changes the mm_iommu_xxx API to check this against # the IOMMU page size. # # This calculates maximum page size as a minimum of the natural region # alignment and compound page size. For the page shift this uses the shift # returned by find_linux_pte() which indicates how the page is mapped to # the current userspace - if the page is huge and this is not a zero, then # it is a leaf pte and the page is mapped within the range. # # Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO") # Cc: stable@vger.kernel.org # v4.12+ # Signed-off-by: Alexey Kardashevskiy # Reviewed-by: David Gibson # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-gcc --version # < git log --format=%s --max-count=1 76fa4975f3ed12d15762bc979ca44078598ed8ee # < make -s -j 20 ARCH=powerpc O=/kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- randconfig KCONFIG_SEED=0x6FF12240 # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_CPU_BIG_ENDIAN=y # Added to kconfig CONFIG_PPC64=y # Added to kconfig CONFIG_PPC_DISABLE_WERROR=y # Added to kconfig CONFIG_SECTION_MISMATCH_WARN_ONLY=y # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # Added to kconfig CONFIG_CC_STACKPROTECTOR_STRONG=n # Added to kconfig CONFIG_GCC_PLUGINS=n # Added to kconfig CONFIG_LD_HEAD_STUB_CATCH=y # Added to kconfig # yes \n | make -s -j 20 ARCH=powerpc O=/kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- oldconfig yes: standard output: Broken pipe yes: write error # make -s -j 20 ARCH=powerpc O=/kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- /kisskb/src/net/Makefile:24: CC cannot link executables. Skipping bpfilter. /kisskb/src/arch/powerpc/platforms/cell/spufs/sched.c:1077:12: warning: 'show_spu_loadavg' defined but not used [-Wunused-function] In file included from /kisskb/src/arch/powerpc/xmon/xmon.c:66:0: /kisskb/src/arch/powerpc/xmon/dis-asm.h: In function 'print_insn_powerpc': /kisskb/src/arch/powerpc/xmon/dis-asm.h:20:2: warning: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'long unsigned int' [-Wformat] /kisskb/src/arch/powerpc/xmon/dis-asm.h: In function 'print_insn_spu': /kisskb/src/arch/powerpc/xmon/dis-asm.h:26:2: warning: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'long unsigned int' [-Wformat] /kisskb/src/kernel/cgroup/cgroup-v1.c: In function 'cgroup1_mount': /kisskb/src/kernel/cgroup/cgroup-v1.c:1256:20: warning: 'root' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/arch/powerpc/kernel/eeh.c:1752:12: warning: 'proc_eeh_show' defined but not used [-Wunused-function] /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:183:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/Makefile:24: CC cannot link executables. Skipping bpfilter. /kisskb/src/net/bridge/br_netlink.c: In function 'br_process_vlan_info.isra.25': /kisskb/src/net/bridge/br_netlink.c:579:10: warning: 'err' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function 'regmap_raw_read': /kisskb/src/drivers/base/regmap/regmap.c:2497:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function '_regmap_raw_write': /kisskb/src/drivers/base/regmap/regmap.c:1819:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/f2fs/file.c: In function 'f2fs_precache_extents': /kisskb/src/fs/f2fs/file.c:2823:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/f2fs/segment.c: In function 'f2fs_flush_sit_entries': /kisskb/src/fs/f2fs/segment.c:3461:5: warning: array subscript is below array bounds [-Warray-bounds] /kisskb/src/fs/f2fs/sysfs.c:519:12: warning: 'segment_info_seq_show' defined but not used [-Wunused-function] /kisskb/src/fs/f2fs/sysfs.c:546:12: warning: 'segment_bits_seq_show' defined but not used [-Wunused-function] /kisskb/src/fs/f2fs/sysfs.c:570:12: warning: 'iostat_info_seq_show' defined but not used [-Wunused-function] /kisskb/src/drivers/connector/connector.c:242:12: warning: 'cn_proc_show' defined but not used [-Wunused-function] /kisskb/src/fs/btrfs/ref-verify.c: In function 'process_extent_item.isra.3': /kisskb/src/fs/btrfs/ref-verify.c:503:2: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/btrfs/ref-verify.c: In function 'process_leaf': /kisskb/src/fs/btrfs/ref-verify.c:555:2: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/dma-buf/reservation.c: In function 'reservation_object_add_shared_replace': /kisskb/src/drivers/dma-buf/reservation.c:207:2: warning: 'k' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/dma-buf/reservation.c:210:7: warning: 'i' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c: In function 'amdgpu_set_pp_od_clk_voltage': /kisskb/src/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c:532:5: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/md/dm-writecache.c: In function 'persistent_memory_claim': /kisskb/src/drivers/md/dm-writecache.c:308:1: warning: no return statement in function returning non-void [-Wreturn-type] /kisskb/src/drivers/nvme/host/lightnvm.c: In function 'nvme_nvm_get_chk_meta': /kisskb/src/drivers/nvme/host/lightnvm.c:624:2: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c: In function 'gk104_top_oneinit': /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c:102:1: warning: 'inst' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c:102:1: warning: 'type' may be used uninitialized in this function [-Wuninitialized] Completed OK # rm -rf /kisskb/build/powerpc-fixes_powerpc-randconfig_powerpc # Build took: 0:03:49.693102