Yan Zhao cd3c5e4e0d vfio/type1: check pfn valid before converting to struct page ... [ Upstream commit 4752354af7 ] Check physical PFN is valid before converting the PFN to a struct page pointer to be returned to caller of vfio_pin_pages(). vfio_pin_pages() pins user pages with contiguous IOVA. If the IOVA of a user page to be pinned belongs to vma of vm_flags VM_PFNMAP, pin_user_pages_remote() will return -EFAULT without returning struct page address for this PFN. This is because usually this kind of PFN (e.g. MMIO PFN) has no valid struct page address associated. Upon this error, vaddr_get_pfns() will obtain the physical PFN directly. While previously vfio_pin_pages() returns to caller PFN arrays directly, after commit 34a255e676 ("vfio: Replace phys_pfn with pages for vfio_pin_pages()"), PFNs will be converted to "struct page *" unconditionally and therefore the returned "struct page *" array may contain invalid struct page addresses. Given current in-tree users of vfio_pin_pages() only expect "struct page * returned, check PFN validity and return -EINVAL to let the caller be aware of IOVAs to be pinned containing PFN not able to be returned in "struct page *" array. So that, the caller will not consume the returned pointer (e.g. test PageReserved()) and avoid error like "supervisor read access in kernel mode". Fixes: 34a255e676 ("vfio: Replace phys_pfn with pages for vfio_pin_pages()") Cc: Sean Christopherson <seanjc@google.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Yan Zhao <yan.y.zhao@intel.com> Reviewed-by: Sean Christopherson <seanjc@google.com> Link: https://lore.kernel.org/r/20230519065843.10653-1-yan.y.zhao@intel.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-06-05 09:26:19 +02:00
..
fsl-mc	vfio/fsl-mc: Use the new device life cycle helpers	2022-09-21 14:15:11 -06:00
mdev	vfio/mdev: add mdev available instance checking to the core	2022-10-04 12:06:58 -06:00
pci	vfio/pci: Check the device set open count on reset	2022-11-10 12:03:36 -07:00
platform	vfio: platform: Do not pass return buffer to ACPI _RST method	2022-12-31 13:32:38 +01:00
container.c	vfio: Change vfio_group->group_rwsem to a mutex	2022-10-04 12:06:58 -06:00
iova_bitmap.c	vfio/iova_bitmap: refactor iova_bitmap_set() to better handle page boundaries	2022-12-31 13:32:41 +01:00
Kconfig	vfio: Introduce the DMA logging feature support	2022-09-08 12:59:00 -06:00
Makefile	vfio: Move container code into drivers/vfio/container.c	2022-09-22 15:46:06 -06:00
vfio.h	vfio: Make the group FD disassociate from the iommu_group	2022-10-07 08:10:52 -06:00
vfio_iommu_spapr_tce.c
vfio_iommu_type1.c	vfio/type1: check pfn valid before converting to struct page	2023-06-05 09:26:19 +02:00
vfio_main.c	vfio: Export the device set open count	2022-11-10 12:03:36 -07:00
vfio_spapr_eeh.c
virqfd.c