kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Robin Murphy e17f2b5161 iommu/vt-d: Fix scatterlist offset handling 
commit 29a90b7089 upstream.

The intel-iommu DMA ops fail to correctly handle scatterlists where
sg->offset is greater than PAGE_SIZE - the IOVA allocation is computed
appropriately based on the page-aligned portion of the offset, but the
mapping is set up relative to sg->page, which means it fails to actually
cover the whole buffer (and in the worst case doesn't cover it at all):

    (sg->dma_address + sg->dma_len) ----+
    sg->dma_address ---------+          |
    iov_pfn------+           |          |
                 |           |          |
                 v           v          v
iova:   a        b        c        d        e        f
        |--------|--------|--------|--------|--------|
                          <...calculated....>
                 [_____mapped______]
pfn:    0        1        2        3        4        5
        |--------|--------|--------|--------|--------|
                 ^           ^          ^
                 |           |          |
    sg->page ----+           |          |
    sg->offset --------------+          |
    (sg->offset + sg->length) ----------+

As a result, the caller ends up overrunning the mapping into whatever
lies beyond, which usually goes badly:

[  429.645492] DMAR: DRHD: handling fault status reg 2
[  429.650847] DMAR: [DMA Write] Request device [02:00.4] fault addr f2682000 ...

Whilst this is a fairly rare occurrence, it can happen from the result
of intermediate scatterlist processing such as scatterwalk_ffwd() in the
crypto layer. Whilst that particular site could be fixed up, it still
seems worthwhile to bring intel-iommu in line with other DMA API
implementations in handling this robustly.

To that end, fix the intel_map_sg() path to line up the mapping
correctly (in units of MM pages rather than VT-d pages to match the
aligned_nrpages() calculation) regardless of the offset, and use
sg_phys() consistently for clarity.

Reported-by: Harsh Jain <Harsh@chelsio.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed by: Ashok Raj <ashok.raj@intel.com>
Tested by: Jacob Pan <jacob.jun.pan@intel.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-12-14 09:28:13 +01:00
..
accessibility printk: move braille console support into separate braille.[ch] files 2013-07-31 14:41:03 -07:00
acpi ACPI / EC: Fix regression related to triggering source of EC event handling 2017-11-30 08:39:01 +00:00
amba ARM: 8596/1: amba: Support clk parents and rates assigned in DT 2016-08-12 16:47:07 +01:00
android ANDROID: binder: fix proc->tsk check. 2017-08-30 10:21:53 +02:00
ata ata: fixes kernel crash while tracing ata_eh_link_autopsy event 2017-11-30 08:39:04 +00:00
atm atm: fix improper return value 2016-12-05 14:53:46 -05:00
auxdisplay auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches 2017-03-30 09:41:27 +02:00
base isa: Prevent NULL dereference in isa_bus driver callbacks 2017-12-14 09:28:11 +01:00
bcma bcma: use (get|put)_device when probing/removing device driver 2017-03-12 06:41:52 +01:00
block rbd: use GFP_NOIO for parent stat and data requests 2017-11-15 15:53:20 +01:00
bluetooth Bluetooth: btusb: fix QCA Rome suspend/resume 2017-11-21 09:23:21 +01:00
bus bus: mbus: fix window size calculation for 4GB windows 2017-10-27 10:38:08 +02:00
cdrom cdrom: support read sub-channel command in LBA format 2016-07-12 08:24:50 -07:00
char ipmi: fix unsigned long underflow 2017-11-24 08:33:42 +01:00
clk clk: qcom: ipq4019: Add all the frequencies for apss cpu 2017-11-30 08:39:13 +00:00
clocksource clockevents/drivers/cs5535: Improve resilience to spurious interrupts 2017-10-27 10:38:08 +02:00
connector connector: make cn_proc explicitly non-modular 2016-07-05 11:40:47 -07:00
cpufreq cpufreq: Do not clear real_cpus mask on policy init 2017-11-08 10:08:33 +01:00
cpuidle Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2016-10-15 09:26:12 -07:00
crypto Revert "crypto: caam - get rid of tasklet" 2017-12-09 22:01:46 +01:00
dax device-dax: fix sysfs duplicate warnings 2017-08-06 18:59:43 -07:00
dca dmaengine: ioatdma: constify dca_ops structures 2015-11-16 09:27:32 +05:30
devfreq PM / devfreq: Fix memory leak when fail to register device 2017-09-27 14:39:24 +02:00
dio m68k: don't export static inline functions 2009-12-06 11:18:28 +01:00
dma dmaengine: pl330: fix double lock 2017-12-09 22:01:53 +01:00
dma-buf dma-buf: Update kerneldoc for sync_file_create 2017-12-09 22:01:56 +01:00
edac EDAC, sb_edac: Fix missing break in switch 2017-12-09 22:01:49 +01:00
eisa Revert "EISA: Initialize device before its resources" 2014-01-17 14:57:29 -07:00
extcon extcon: palmas: Check the parent instance to prevent the NULL 2017-11-21 09:23:21 +01:00
firewire firewire: net: fix fragmented datagram_size off-by-one 2016-11-03 14:46:39 +01:00
firmware efi/esrt: Use memunmap() instead of kfree() to free the remapping 2017-12-14 09:28:11 +01:00
fmc Merge 3.14-rc5 into char-misc-next 2014-03-02 19:53:09 -08:00
fpga fpga manager: Add hardware dependency to Zynq driver 2016-09-08 17:31:44 +02:00
gpio gpio: mockup: dynamically allocate memory for chip name 2017-11-30 08:39:13 +00:00
gpu drm/amdgpu: fix unload driver issue for virtual display 2017-12-09 22:01:53 +01:00
hid HID: usbhid: fix out-of-bounds bug 2017-10-18 09:35:38 +02:00
hsi HSI: omap_ssi: drop pm_runtime_irq_safe 2016-06-28 00:40:08 +02:00
hv Drivers: hv: fcopy: restore correct transfer length 2017-10-12 11:51:24 +02:00
hwmon hwmon: (jc42) optionally try to disable the SMBUS timeout 2017-12-05 11:24:34 +01:00
hwspinlock hwspinlock: qcom_hwspinlock: add missing of_node_put after calling of_parse_phandle 2016-07-06 12:20:34 -07:00
hwtracing stm class: Fix a use-after-free 2017-10-12 11:51:24 +02:00
i2c i2c: i2c-cadence: Initialize configuration before probing devices 2017-12-09 22:01:53 +01:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2016-07-29 13:29:06 -07:00
idle x86/intel_idle: Add CPU model 0x4a (Atom Z34xx series) 2017-04-12 12:41:17 +02:00
iio iio: adc: ti-ads1015: add 10% to conversion wait time 2017-12-09 22:01:49 +01:00
infiniband RDMA/qedr: Fix RDMA CM loopback 2017-12-09 22:01:53 +01:00
input Input: ims-psu - check if CDC union descriptor is sane 2017-11-18 11:22:24 +01:00
iommu iommu/vt-d: Fix scatterlist offset handling 2017-12-14 09:28:13 +01:00
ipack ipack: print a hex number after a 0x prefix 2016-10-27 18:43:43 -07:00
irqchip irqchip/gic-v3: Fix ppi-partitions lookup 2017-11-30 08:39:06 +00:00
isdn isdn/i4l: fetch the ppp_write buffer in one shot 2017-10-12 11:51:21 +02:00
leds Revert "leds: handle suspend/resume in heartbeat trigger" 2017-08-30 10:21:51 +02:00
lguest Merge branch 'x86/urgent' into x86/asm to pick up dependent fixes 2016-04-13 11:36:44 +02:00
lightnvm Merge branch 'for-4.9/block' of git://git.kernel.dk/linux-block 2016-10-07 14:42:05 -07:00
macintosh powerpc: Remove all usages of NO_IRQ 2016-09-20 20:57:12 +10:00
mailbox mailbox: handle empty message in tx_tick 2017-08-06 18:59:42 -07:00
mcb MCB: add support for SC31 to mcb-lpc 2017-09-09 17:39:41 +02:00
md bcache: recover data from backing when data is clean 2017-12-09 22:01:46 +01:00
media media: v4l2-ctrl: Fix flags field on Control events 2017-11-30 08:39:09 +00:00
memory memory/atmel-ebi: Fix ns <-> cycles conversions 2017-03-15 10:02:45 +08:00
memstick memstick: rtsx_usb_ms: Manage runtime PM when accessing the device 2016-10-17 15:43:05 +02:00
message scsi: fusion: Fix error return code in mptfc_probe() 2016-09-14 14:26:19 -04:00
mfd mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot 2017-12-05 11:24:32 +01:00
misc eeprom: at24: check at24_read/write arguments 2017-12-05 11:24:34 +01:00
mmc mmc: sdhci-msm: fix issue with power irq 2017-12-09 22:01:48 +01:00
mtd mtd: nand: mtk: fix infinite ECC decode IRQ issue 2017-11-30 08:39:06 +00:00
net can: usb_8dev: cancel urb on -EPIPE and -EPROTO 2017-12-14 09:28:10 +01:00
nfc nfc: fdp: fix NULL pointer dereference 2017-08-06 18:59:42 -07:00
ntb ntb: transport shouldn't disable link due to bogus values in SPADs 2017-08-30 10:21:55 +02:00
nubus nubus: Remove superfluous interrupt disable/restore 2014-10-27 11:03:19 +01:00
nvdimm libnvdimm, namespace: make 'resource' attribute only readable by root 2017-11-30 08:39:07 +00:00
nvme nvmet: cancel fatal error and flush async work before free controller 2017-12-09 22:01:54 +01:00
nvmem nvmem: imx-ocotp: Fix wrong register size 2017-08-06 18:59:48 -07:00
of of: device: Export of_device_{get_modalias, uvent_modalias} to modules 2017-07-27 15:08:08 -07:00
oprofile Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-10 20:16:43 -07:00
parisc parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo 2017-08-24 17:12:18 -07:00
parport parisc, parport_gsc: Fixes for printk continuation lines 2017-06-17 06:41:54 +02:00
pci PCI: Apply _HPX settings only to relevant devices 2017-11-30 08:39:10 +00:00
pcmcia pcmcia: fix return value of soc_pcmcia_regulator_set 2016-11-11 08:45:08 -08:00
perf perf: xgene: Remove bogus IS_ERR() check 2016-10-17 15:50:07 +01:00
phy phy: qcom-usb-hs: Add depends on EXTCON 2017-05-14 14:00:19 +02:00
pinctrl pinctrl: sirf: atlas7: Add missing 'of_node_put()' 2017-11-30 08:39:12 +00:00
platform platform/x86: hp-wmi: Do not shadow error values 2017-11-15 15:53:17 +01:00
pnp PNP: isapnp: make core more explicitly non-modular 2016-08-16 22:53:59 +02:00
power power: supply: axp288_fuel_gauge: Read 12 bit values 2 registers at a time 2017-11-21 09:23:25 +01:00
powercap powercap/intel_rapl: fix and tidy up error handling 2017-01-19 20:18:07 +01:00
pps pps: kc: fix non-tickless system config dependency 2016-10-11 15:06:32 -07:00
ps3 powerpc: Remove all usages of NO_IRQ 2016-09-20 20:57:12 +10:00
ptp drivers/ptp: Fix kernel memory disclosure 2016-10-13 10:20:06 -04:00
pwm pwm: rockchip: State of PWM clock should synchronize with PWM enabled state 2017-04-21 09:31:22 +02:00
rapidio drivers/rapidio/devices/tsi721.c: make module parameter variable name unique 2017-10-08 10:26:09 +02:00
ras x86/ras: Move AMD MCE injector to arch/x86/ras/ 2015-08-13 10:12:54 +02:00
regulator regulator: fan53555: fix I2C device ids 2017-11-02 09:49:15 +01:00
remoteproc remoteproc: qcom: mdt_loader: Don't overwrite firmware object 2017-03-12 06:41:50 +01:00
reset reset: ti_syscon: fix a ti_syscon_reset_status issue 2017-10-08 10:26:03 +02:00
rpmsg rpmsg: virtio_rpmsg_bus: fix channel creation 2017-01-26 08:24:44 +01:00
rtc rtc: rx8010: change lock mechanism 2017-11-21 09:23:25 +01:00
s390 s390/qeth: issue STARTLAN as first IPA command 2017-11-15 15:53:16 +01:00
sbus openprom: fix warning 2016-05-20 18:33:37 -07:00
scsi scsi: use dma_get_cache_alignment() as minimum DMA alignment 2017-12-14 09:28:11 +01:00
sfi SFI: fix compiler warnings 2014-12-03 18:49:20 -05:00
sh drivers: sh: Stop using the legacy clock domain on ARM 2016-05-30 09:41:11 +09:00
sn Drivers: misc: remove __dev* attributes. 2013-01-03 15:57:16 -08:00
soc soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe() 2017-01-26 08:24:45 +01:00
spi spi: spi-axi: fix potential use-after-free after deregistration 2017-12-09 22:01:48 +01:00
spmi spmi: Include OF based modalias in device uevent 2017-07-27 15:08:08 -07:00
ssb ssb: Fix error routine when fallback SPROM fails 2017-01-09 08:32:16 +01:00
staging cec: initiator should be the same as the destination for, poll 2017-12-09 22:01:54 +01:00
target target: Fix QUEUE_FULL + SCSI task attribute handling 2017-11-30 08:39:06 +00:00
tc TC: Error handling clean-ups 2014-11-24 07:45:25 +01:00
thermal thermal: cpu_cooling: Avoid accessing potentially freed structures 2017-07-27 15:07:55 -07:00
thunderbolt thunderbolt: Don't declare Falcon Ridge unsupported 2016-08-31 13:25:02 +02:00
tty sysrq : fix Show Regs call trace on ARM 2017-12-09 22:01:49 +01:00
uio uio: fix dmem_region_start computation 2016-08-31 13:07:30 +02:00
usb usb: gadget: udc: renesas_usb3: fix number of the pipes 2017-12-14 09:28:09 +01:00
uwb uwb: ensure that endpoint is interrupt 2017-10-12 11:51:19 +02:00
vfio vfio/spapr: Fix missing mutex unlock when creating a window 2017-12-09 22:01:54 +01:00
vhost fix a page leak in vhost_scsi_iov_to_sgl() error recovery 2017-11-30 08:39:05 +00:00
video backlight: adp5520: Fix error handling in adp5520_bl_probe() 2017-11-21 09:23:25 +01:00
virt mm: replace get_user_pages() write/force parameters with gup_flags 2016-10-19 08:11:43 -07:00
virtio virtio: release virtio index when fail to device_register 2017-12-14 09:28:10 +01:00
vlynq drivers/vlynq/vlynq.c: fix another resource size off by 1 error 2014-01-23 16:36:55 -08:00
vme VME: restore bus_remove function causing incomplete module unload 2017-03-12 06:41:50 +01:00
w1 w1: ds2490: USB transfer buffers need to be DMAable 2017-03-12 06:41:48 +01:00
watchdog watchdog: kempld: fix gcc-4.3 build 2017-10-21 17:21:33 +02:00
xen xen: xenbus driver must not accept invalid transaction ids 2017-11-30 08:39:15 +00:00
zorro zorro: Use kobj_to_dev() 2016-01-25 09:42:23 +01:00
Kconfig libnvdimm for 4.7 2016-05-23 11:18:01 -07:00
Makefile usb: Make sure usb/phy/of gets built-in 2017-05-20 14:28:35 +02:00