Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f8312a3 authored by Joerg Roedel's avatar Joerg Roedel
Browse files

iommu/vt-d: Do access checks before calling handle_mm_fault() 



Not doing so is a bug and might trigger a BUG_ON in
handle_mm_fault(). So add the proper permission checks
before calling into mm code.

Reviewed-by: default avatarJesse Barnes <jbarnes@virtuousgeek.org>
Acked-By: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 7b5cc1a9

drivers/iommu/intel-svm.c

+20 −0
Original line number Diff line number Diff line
@@ -484,6 +484,23 @@ struct page_req_dsc { 
};



#define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x10)



static bool access_error(struct vm_area_struct *vma, struct page_req_dsc *req)

{

	unsigned long requested = 0;



	if (req->exe_req)

		requested |= VM_EXEC;



	if (req->rd_req)

		requested |= VM_READ;



	if (req->wr_req)

		requested |= VM_WRITE;



	return (requested & ~vma->vm_flags) != 0;

}



static irqreturn_t prq_event_thread(int irq, void *d)

{

	struct intel_iommu *iommu = d;
@@ -539,6 +556,9 @@ static irqreturn_t prq_event_thread(int irq, void *d) 
		if (!vma || address < vma->vm_start)

			goto invalid;



		if (access_error(vma, req))

			goto invalid;



		ret = handle_mm_fault(svm->mm, vma, address,

				      req->wr_req ? FAULT_FLAG_WRITE : 0);

		if (ret & VM_FAULT_ERROR)