kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/iommu
History
Jason Gunthorpe cd6dd564ae iommufd: Protect against overflow of ALIGN() during iova allocation 
commit 8f6887349b upstream.

Userspace can supply an iova and uptr such that the target iova alignment
becomes really big and ALIGN() overflows which corrupts the selected area
range during allocation. CONFIG_IOMMUFD_TEST can detect this:

   WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]
   WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352
   Modules linked in:
   CPU: 1 PID: 5092 Comm: syz-executor294 Not tainted 6.10.0-rc5-syzkaller-00294-g3ffea9a7a6f7 #0
   Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
   RIP: 0010:iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]
   RIP: 0010:iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352
   Code: fc e9 a4 f3 ff ff e8 1a 8b 4c fc 41 be e4 ff ff ff e9 8a f3 ff ff e8 0a 8b 4c fc 90 0f 0b 90 e9 37 f5 ff ff e8 fc 8a 4c fc 90 <0f> 0b 90 e9 68 f3 ff ff 48 c7 c1 ec 82 ad 8f 80 e1 07 80 c1 03 38
   RSP: 0018:ffffc90003ebf9e0 EFLAGS: 00010293
   RAX: ffffffff85499fa4 RBX: 00000000ffffffef RCX: ffff888079b49e00
   RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000
   RBP: ffffc90003ebfc50 R08: ffffffff85499b30 R09: ffffffff85499942
   R10: 0000000000000002 R11: ffff888079b49e00 R12: ffff8880228e0010
   R13: 0000000000000000 R14: 1ffff920007d7f68 R15: ffffc90003ebfd00
   FS:  000055557d760380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   CR2: 00000000005fdeb8 CR3: 000000007404a000 CR4: 00000000003506f0
   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
   Call Trace:
    <TASK>
    iommufd_ioas_copy+0x610/0x7b0 drivers/iommu/iommufd/ioas.c:274
    iommufd_fops_ioctl+0x4d9/0x5a0 drivers/iommu/iommufd/main.c:421
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:907 [inline]
    __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
    do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

Cap the automatic alignment to the huge page size, which is probably a
better idea overall. Huge automatic alignments can fragment and chew up
the available IOVA space without any reason.

Link: https://patch.msgid.link/r/0-v1-8009738b9891+1f7-iommufd_align_overflow_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: 51fe6141f0 ("iommufd: Data structure to provide IOVA to PFN mapping")
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reported-by: syzbot+16073ebbc4c64b819b47@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/000000000000388410061a74f014@google.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-10-04 16:29:46 +02:00
..
amd iommu/amd: Do not set the D bit on AMD v2 table entries 2024-10-04 16:29:07 +02:00
arm iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660 2024-10-04 16:29:08 +02:00
intel iommu/vt-d: Handle volatile descriptor status read 2024-09-12 11:11:35 +02:00
iommufd iommufd: Protect against overflow of ALIGN() during iova allocation 2024-10-04 16:29:46 +02:00
apple-dart.c iommu/apple-dart: Handle DMA_FQ domains in attach_dev() 2023-09-25 11:37:19 +02:00
dma-iommu.c Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
dma-iommu.h iommu: Optimise PCI SAC address trick 2023-07-14 16:14:17 +02:00
exynos-iommu.c Merge branches 'iommu/fixes', 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/omap', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 'unisoc', 'x86/vt-d', 'x86/amd', 'core' and 'platform-remove_new' into next 2023-04-14 13:45:50 +02:00
fsl_pamu.c iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c 2023-03-22 14:50:15 +01:00
fsl_pamu.h iommu/fsl_pamu: hardcode the window address and size in pamu_config_ppaace 2021-04-07 10:56:52 +02:00
fsl_pamu_domain.c iommu/fsl: Use driver_managed_dma to allow VFIO to work 2023-06-01 11:47:48 +02:00
fsl_pamu_domain.h iommu/fsl_pamu: remove the snoop_id field 2021-04-07 10:56:52 +02:00
hyperv-iommu.c x86/vector: Rename send_cleanup_vector() to vector_schedule_cleanup() 2023-08-06 14:15:09 +02:00
io-pgfault.c iommu: Rename iommu-sva-lib.{c,h} 2022-11-03 15:47:54 +01:00
io-pgtable-arm-v7s.c iommu: Do not return 0 from map_pages if it doesn't do anything 2024-09-04 13:28:26 +02:00
io-pgtable-arm.c iommu: Do not return 0 from map_pages if it doesn't do anything 2024-09-04 13:28:26 +02:00
io-pgtable-arm.h iommu/io-pgtable-arm: Move some definitions to a header 2020-09-28 23:48:06 +01:00
io-pgtable-dart.c iommu: Do not return 0 from map_pages if it doesn't do anything 2024-09-04 13:28:26 +02:00
io-pgtable.c Merge branches 'apple/dart', 'arm/mediatek', 'arm/omap', 'arm/smmu', 'virtio', 'x86/vt-d', 'x86/amd' and 'core' into next 2022-09-26 15:52:31 +02:00
iommu-debugfs.c iommu: Fix IOMMU debugfs fallout 2019-02-26 11:15:58 +01:00
iommu-priv.h iommu: Move dev_iommu_ops() to private header 2023-08-18 12:52:15 -03:00
iommu-sva.c iommu: Move global PASID allocation from SVA to core 2023-08-09 17:44:36 +02:00
iommu-sva.h iommu: Remove ioasid infrastructure 2023-03-31 10:03:31 +02:00
iommu-sysfs.c iommu: Do not export iommu_device_link/unlink() 2023-07-14 16:14:15 +02:00
iommu-traces.c iommu: Remove detach_dev callback 2023-01-13 16:39:18 +01:00
iommu.c iommu: Undo pasid attachment only for the devices that have succeeded 2024-06-12 11:12:06 +02:00
iova.c iommu/iova: Optimize iova_magazine_alloc() 2023-05-22 17:09:51 +02:00
ipmmu-vmsa.c Merge branches 'apple/dart', 'arm/mediatek', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'unisoc', 'x86/vt-d', 'x86/amd' and 'core' into next 2023-08-21 14:18:43 +02:00
irq_remapping.c iommu: Fix compilation without CONFIG_IOMMU_INTEL 2024-03-26 18:19:39 -04:00
irq_remapping.h x86: Kill all traces of irq_remapping_get_irq_domain() 2020-10-28 20:26:28 +01:00
Kconfig iommu: Fix compilation without CONFIG_IOMMU_INTEL 2024-03-26 18:19:39 -04:00
Makefile iommu: Remove ioasid infrastructure 2023-03-31 10:03:31 +02:00
msm_iommu.c iommu/msm: Convert to platform remove callback returning void 2023-03-31 10:01:57 +02:00
msm_iommu.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 267 2019-06-05 17:30:29 +02:00
msm_iommu_hw-8xxx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 267 2019-06-05 17:30:29 +02:00
mtk_iommu.c iommu: mtk: fix module autoloading 2024-05-17 12:02:17 +02:00
mtk_iommu_v1.c iommu: mtk: fix module autoloading 2024-05-17 12:02:17 +02:00
of_iommu.c iommu: Don't reserve 0-length IOVA region 2024-01-25 15:35:54 -08:00
omap-iommu-debug.c iommu/omap: Fix buffer overflow in debugfs 2022-09-07 10:42:28 +02:00
omap-iommu.c Merge branches 'iommu/fixes', 'arm/allwinner', 'arm/exynos', 'arm/mediatek', 'arm/omap', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'ppc/pamu', 'unisoc', 'x86/vt-d', 'x86/amd', 'core' and 'platform-remove_new' into next 2023-04-14 13:45:50 +02:00
omap-iommu.h iommu/omap: add support for late attachment of iommu devices 2019-08-09 17:37:10 +02:00
omap-iopgtable.h iommu/omap: Fix -Woverflow warnings when compiling on 64-bit architectures 2020-03-04 16:24:46 +01:00
rockchip-iommu.c iommu: rockchip: Allocate tables from all available memory for IOMMU v2 2023-07-14 16:18:04 +02:00
s390-iommu.c iommufd for 6.3 2023-02-24 14:34:12 -08:00
sprd-iommu.c iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en 2024-08-03 08:54:41 +02:00
sun50i-iommu.c iommu: sun50i: clear bypass register 2024-09-12 11:11:29 +02:00
tegra-gart.c iommu: Add set_platform_dma_ops callbacks 2023-01-13 16:39:16 +01:00
tegra-smmu.c iommu: Explicitly include correct DT includes 2023-08-21 14:17:59 +02:00
virtio-iommu.c iommu: Explicitly include correct DT includes 2023-08-21 14:17:59 +02:00