Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e28fb0f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'vfio-v5.1-rc4' of git://github.com/awilliam/linux-vfio 

Pull VFIO fixes from Alex Williamson:

 - Fix clang printk format errors (Louis Taylor)

 - Declare structure static to fix sparse warning (Wang Hai)

 - Limit user DMA mappings per container (CVE-2019-3882) (Alex
   Williamson)

* tag 'vfio-v5.1-rc4' of git://github.com/awilliam/linux-vfio:
  vfio/type1: Limit DMA mappings per container
  vfio/spapr_tce: Make symbol 'tce_iommu_driver_ops' static
  vfio/pci: use correct format characters
parents bc5725f9 49285593

drivers/vfio/pci/vfio_pci.c

+2 −2
Original line number Diff line number Diff line
@@ -1661,11 +1661,11 @@ static void __init vfio_pci_fill_ids(void) 
		rc = pci_add_dynid(&vfio_pci_driver, vendor, device,

				   subvendor, subdevice, class, class_mask, 0);

		if (rc)

			pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",

			pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",

				vendor, device, subvendor, subdevice,

				class, class_mask, rc);

		else

			pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",

			pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",

				vendor, device, subvendor, subdevice,

				class, class_mask);

	}

drivers/vfio/vfio_iommu_spapr_tce.c

+1 −1
Original line number Diff line number Diff line
@@ -1398,7 +1398,7 @@ static void tce_iommu_detach_group(void *iommu_data, 
	mutex_unlock(&container->lock);

}



const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {

static const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {

	.name		= "iommu-vfio-powerpc",

	.owner		= THIS_MODULE,

	.open		= tce_iommu_open,

drivers/vfio/vfio_iommu_type1.c

+14 −0
Original line number Diff line number Diff line
@@ -58,12 +58,18 @@ module_param_named(disable_hugepages, 
MODULE_PARM_DESC(disable_hugepages,

		 "Disable VFIO IOMMU support for IOMMU hugepages.");



static unsigned int dma_entry_limit __read_mostly = U16_MAX;

module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);

MODULE_PARM_DESC(dma_entry_limit,

		 "Maximum number of user DMA mappings per container (65535).");



struct vfio_iommu {

	struct list_head	domain_list;

	struct vfio_domain	*external_domain; /* domain for external user */

	struct mutex		lock;

	struct rb_root		dma_list;

	struct blocking_notifier_head notifier;

	unsigned int		dma_avail;

	bool			v2;

	bool			nesting;

};
@@ -836,6 +842,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma) 
	vfio_unlink_dma(iommu, dma);

	put_task_struct(dma->task);

	kfree(dma);

	iommu->dma_avail++;

}



static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
@@ -1081,12 +1088,18 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu, 
		goto out_unlock;

	}



	if (!iommu->dma_avail) {

		ret = -ENOSPC;

		goto out_unlock;

	}



	dma = kzalloc(sizeof(*dma), GFP_KERNEL);

	if (!dma) {

		ret = -ENOMEM;

		goto out_unlock;

	}



	iommu->dma_avail--;

	dma->iova = iova;

	dma->vaddr = vaddr;

	dma->prot = prot;
@@ -1583,6 +1596,7 @@ static void *vfio_iommu_type1_open(unsigned long arg) 


	INIT_LIST_HEAD(&iommu->domain_list);

	iommu->dma_list = RB_ROOT;

	iommu->dma_avail = dma_entry_limit;

	mutex_init(&iommu->lock);

	BLOCKING_INIT_NOTIFIER_HEAD(&iommu->notifier);