From patchwork Wed Apr 10 15:55:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Hildenbrand X-Patchwork-Id: 13624779 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73D5FCD1299 for ; Wed, 10 Apr 2024 15:56:18 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id ECB616B00A8; Wed, 10 Apr 2024 11:56:17 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E55766B00AB; Wed, 10 Apr 2024 11:56:17 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CCD266B00AC; Wed, 10 Apr 2024 11:56:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id A97966B00A8 for ; Wed, 10 Apr 2024 11:56:17 -0400 (EDT) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 2EFB4C0850 for ; Wed, 10 Apr 2024 15:56:15 +0000 (UTC) X-FDA: 81994073910.24.F1A8284 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf08.hostedemail.com (Postfix) with ESMTP id 61C21160052 for ; Wed, 10 Apr 2024 15:56:03 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=MqeNvWmh; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf08.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712764563; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=EdXXvnzyQGyp+LpfjwfWgygVrfKZBZQWfHJtEeA5yjk=; b=r9aM0Sv9DxH3FvcjTZ9uEyTEo8XlUnk1n7sVfRpDmhPJw5jBhsCrWA6IK28UtRQchl2dmc gOFIInGyhfQLkk4j7FYSoCMAAWyEre552UOvEXVTM8rJ1mqj1JXS3wg/q+FPTDW0uxZAkF NFHx5YqJVXPDrDREzNCKawaN7faFIEg= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=MqeNvWmh; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf08.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712764563; a=rsa-sha256; cv=none; b=bJ23TSosu1doFQ9PJ8btXjm6b9JG/QPG7GHg7xftq7o8maAZM6VwrXBZcqHXAXi2e6NT/4 L3gCDezqPxOc7Zzkz+dgChaW6h38Qf06DPHsGCB/DSV1erv6hUeD+I1o5shIcOlMJagQ79 sCD2fyo/+p2FOwaj5ArbehHarKP7yPQ= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1712764562; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EdXXvnzyQGyp+LpfjwfWgygVrfKZBZQWfHJtEeA5yjk=; b=MqeNvWmhFXbWYAIa8X2TOFDfg7BpqjsDg/2D2953jiYUCxmm3pvYQpR6JYIgJVodKbu68s R3BKyy/CAHECOzU+PErrQv0LRMC+HkrN4dssl+Yl9RoC/Zt5k2zKHQuaHL/OyXIASauOS8 fkWyT+o98RRn4tlFA0lVnxROXhYEA2I= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-369-QFt8f6HZNKShSzTznoalRA-1; Wed, 10 Apr 2024 11:55:57 -0400 X-MC-Unique: QFt8f6HZNKShSzTznoalRA-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 38C151805BE0; Wed, 10 Apr 2024 15:55:56 +0000 (UTC) Received: from t14s.fritz.box (unknown [10.39.193.162]) by smtp.corp.redhat.com (Postfix) with ESMTP id C8CE72DD51; Wed, 10 Apr 2024 15:55:52 +0000 (UTC) From: David Hildenbrand To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, x86@kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org, David Hildenbrand , Andrew Morton , Yonghua Huang , Fei Li , Christoph Hellwig , Gerald Schaefer , Heiko Carstens , Ingo Molnar , Alex Williamson , Paolo Bonzini Subject: [PATCH v1 1/3] drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() Date: Wed, 10 Apr 2024 17:55:25 +0200 Message-ID: <20240410155527.474777-2-david@redhat.com> In-Reply-To: <20240410155527.474777-1-david@redhat.com> References: <20240410155527.474777-1-david@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.1 X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 61C21160052 X-Stat-Signature: 93f3c5odrsbaauwxxhs6c76yodohmjg9 X-HE-Tag: 1712764563-731650 X-HE-Meta: U2FsdGVkX1/44QSTYZOWNTkbWbywTTH+tBwjlFvONPFn5zaywktV2TTjGbju5lXDhOFLPGmHwtC8wO7myBbUQgmgfeplX63QOKDHD8N/wL4ajaiao4t63b3EyLph15+MHZGhYuR53E8TZ2s4EARXyqdrakBB1D21U8TkHLZrFDar8S94Y+9w8cSx1ujxEf54agpO5T32Ypnkaf3g33taHTx/zzBEHjBXk6EvfGTtupOjbcDL2fADTafy0UyPdswn7N2QtoJf2FF9wmASt6839s1NDf6RYwRGB/is2MyVt1qfht+gac3unvZlua6lFavebgtHOyySuqBOyQCY449GuRpPlJAvAR6x3ZI41CB+ELehAuRcifbQPBBO2kZ9ubTxcxtVKVL30a6RFVr/h7vp6Xwb/h9onXyKHgDQC45O1qvCtl6Mk/fPxbtikAJHU3M1zhDM55LRRv5i92GrvJpHyzk5grhQp1+QO+TIwIYRq/LFIhSxQCB6PXuEB4ePi6u8jebWJfteMRjHMfVgRE07jV8JvlvEpMwU8zyPFjEFP6d5WYisazNZ5N7CBHi63o/NlEJ4T2IgdRNWWq3fG4590VuaZlFUyi7zVaTYIX80k4SfOivqZGQes3W2NkTWSNDboCK/Y/l6QWKkJZWq6O5CD/XVmiPGmfJFMlA6Lp82VriAjxpSTx8xsavXSTWm3qbiLWc/YhWiAkwvUJ4WG93GbdqHojSQgppA0hCM2xzQLfO5b/8gsuJkFzMWcW0jFLry59m6fAuK25u+17ODK5g+kSut4wE8rdCeyInLjTMf1q3aUSXIe8Fdz84nl+wWhsNyZ0hkMDg9X1K4jDIc71bU42aE9Td0DaOSRLojtIdDvMD/9Rp8Ga/YP/v9SViE1uKXvyPNht8c/tYs9oASNytdmXgdjk3YbzguzWJfrHfItL5X284rVAVnwJQbEJBu0FZmu0i7bp+TZFDjrH0eexa iM+LbwVl VUewe+Rir46f5L4Ne7JQ0ie8VUPClNjii5Fwoedit77g136zuyrI8FuSZDQgmwMfmVeF07ZyDF4P2mk7crLkFBKK3fTaERasuDNzcCl1iqyLpQinlLV9soZ2CVtiYUh9pC806IUhnzRskELMPJ/jSSl1oaQWXJjPenVaUk84C8DnA29FeKqkm6AZMJ/Py4QbdPvbC2l0gC1eye8R0OO/BxkyudCdU5MixaeGQ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: We currently miss to handle various cases, resulting in a dangerous follow_pte() (previously follow_pfn()) usage. (1) We're not checking PTE write permissions. Maybe we should simply always require pte_write() like we do for pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for ACRN_MEM_ACCESS_WRITE for now. (2) We're not rejecting refcounted pages. As we are not using MMU notifiers, messing with refcounted pages is dangerous and can result in use-after-free. Let's make sure to reject them. (3) We are only looking at the first PTE of a bigger range. We only lookup a single PTE, but memmap->len may span a larger area. Let's loop over all involved PTEs and make sure the PFN range is actually contiguous. Reject everything else: it couldn't have worked either way, and rather made use access PFNs we shouldn't be accessing. Fixes: 8a6e85f75a83 ("virt: acrn: obtain pa from VMA with PFNMAP flag") Signed-off-by: David Hildenbrand Signed-off-by: Christoph Hellwig Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton --- drivers/virt/acrn/mm.c | 63 +++++++++++++++++++++++++++++++----------- 1 file changed, 47 insertions(+), 16 deletions(-) diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c index b30077baf352..2d98e1e185c4 100644 --- a/drivers/virt/acrn/mm.c +++ b/drivers/virt/acrn/mm.c @@ -156,23 +156,29 @@ int acrn_vm_memseg_unmap(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) { struct vm_memory_region_batch *regions_info; - int nr_pages, i = 0, order, nr_regions = 0; + int nr_pages, i, order, nr_regions = 0; struct vm_memory_mapping *region_mapping; struct vm_memory_region_op *vm_region; struct page **pages = NULL, *page; void *remap_vaddr; int ret, pinned; u64 user_vm_pa; - unsigned long pfn; struct vm_area_struct *vma; if (!vm || !memmap) return -EINVAL; + /* Get the page number of the map region */ + nr_pages = memmap->len >> PAGE_SHIFT; + if (!nr_pages) + return -EINVAL; + mmap_read_lock(current->mm); vma = vma_lookup(current->mm, memmap->vma_base); if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) { + unsigned long start_pfn, cur_pfn; spinlock_t *ptl; + bool writable; pte_t *ptep; if ((memmap->vma_base + memmap->len) > vma->vm_end) { @@ -180,25 +186,53 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) return -EINVAL; } - ret = follow_pte(vma->vm_mm, memmap->vma_base, &ptep, &ptl); - if (ret < 0) { - mmap_read_unlock(current->mm); + for (i = 0; i < nr_pages; i++) { + ret = follow_pte(vma->vm_mm, + memmap->vma_base + i * PAGE_SIZE, + &ptep, &ptl); + if (ret) + break; + + cur_pfn = pte_pfn(ptep_get(ptep)); + if (i == 0) + start_pfn = cur_pfn; + writable = !!pte_write(ptep_get(ptep)); + pte_unmap_unlock(ptep, ptl); + + /* Disallow write access if the PTE is not writable. */ + if (!writable && + (memmap->attr & ACRN_MEM_ACCESS_WRITE)) { + ret = -EFAULT; + break; + } + + /* Disallow refcounted pages. */ + if (pfn_valid(cur_pfn) && + !PageReserved(pfn_to_page(cur_pfn))) { + ret = -EFAULT; + break; + } + + /* Disallow non-contiguous ranges. */ + if (cur_pfn != start_pfn + i) { + ret = -EINVAL; + break; + } + } + mmap_read_unlock(current->mm); + + if (ret) { dev_dbg(acrn_dev.this_device, "Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base); return ret; } - pfn = pte_pfn(ptep_get(ptep)); - pte_unmap_unlock(ptep, ptl); - mmap_read_unlock(current->mm); return acrn_mm_region_add(vm, memmap->user_vm_pa, - PFN_PHYS(pfn), memmap->len, + PFN_PHYS(start_pfn), memmap->len, ACRN_MEM_TYPE_WB, memmap->attr); } mmap_read_unlock(current->mm); - /* Get the page number of the map region */ - nr_pages = memmap->len >> PAGE_SHIFT; pages = vzalloc(array_size(nr_pages, sizeof(*pages))); if (!pages) return -ENOMEM; @@ -242,12 +276,11 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) mutex_unlock(&vm->regions_mapping_lock); /* Calculate count of vm_memory_region_op */ - while (i < nr_pages) { + for (i = 0; i < nr_pages; i += 1 << order) { page = pages[i]; VM_BUG_ON_PAGE(PageTail(page), page); order = compound_order(page); nr_regions++; - i += 1 << order; } /* Prepare the vm_memory_region_batch */ @@ -264,8 +297,7 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) regions_info->vmid = vm->vmid; regions_info->regions_gpa = virt_to_phys(vm_region); user_vm_pa = memmap->user_vm_pa; - i = 0; - while (i < nr_pages) { + for (i = 0; i < nr_pages; i += 1 << order) { u32 region_size; page = pages[i]; @@ -281,7 +313,6 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap) vm_region++; user_vm_pa += region_size; - i += 1 << order; } /* Inform the ACRN Hypervisor to set up EPT mappings */