4.4-stable patches

added patches:
	vfio-type1-limit-dma-mappings-per-container.patch

diff --git a/queue-4.4/series b/queue-4.4/series
index 37f0c93f9ec120748ce7a7b9adbe5cf59807184f..306469dbe6a9a7f68c7895621e15b3f266f0d2ea 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -106,3 +106,4 @@ ceph-fix-use-after-free-on-symlink-traversal.patch
 scsi-zfcp-reduce-flood-of-fcrscn1-trace-records-on-m.patch
 libata-fix-using-dma-buffers-on-stack.patch
 kconfig-mn-conf-handle-backspace-h-key.patch
+vfio-type1-limit-dma-mappings-per-container.patch

diff --git a/queue-4.4/vfio-type1-limit-dma-mappings-per-container.patch b/queue-4.4/vfio-type1-limit-dma-mappings-per-container.patch
new file mode 100644 (file)
index 0000000..39b6246
--- /dev/null
+++ b/queue-4.4/vfio-type1-limit-dma-mappings-per-container.patch
@@ -0,0 +1,93 @@
+From 492855939bdb59c6f947b0b5b44af9ad82b7e38c Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Wed, 3 Apr 2019 12:36:21 -0600
+Subject: vfio/type1: Limit DMA mappings per container
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit 492855939bdb59c6f947b0b5b44af9ad82b7e38c upstream.
+
+Memory backed DMA mappings are accounted against a user's locked
+memory limit, including multiple mappings of the same memory.  This
+accounting bounds the number of such mappings that a user can create.
+However, DMA mappings that are not backed by memory, such as DMA
+mappings of device MMIO via mmaps, do not make use of page pinning
+and therefore do not count against the user's locked memory limit.
+These mappings still consume memory, but the memory is not well
+associated to the process for the purpose of oom killing a task.
+
+To add bounding on this use case, we introduce a limit to the total
+number of concurrent DMA mappings that a user is allowed to create.
+This limit is exposed as a tunable module option where the default
+value of 64K is expected to be well in excess of any reasonable use
+case (a large virtual machine configuration would typically only make
+use of tens of concurrent mappings).
+
+This fixes CVE-2019-3882.
+
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+[groeck: Adjust for missing upstream commit]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/vfio_iommu_type1.c |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -53,10 +53,16 @@ module_param_named(disable_hugepages,
+ MODULE_PARM_DESC(disable_hugepages,
+                "Disable VFIO IOMMU support for IOMMU hugepages.");
+ 
++static unsigned int dma_entry_limit __read_mostly = U16_MAX;
++module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);
++MODULE_PARM_DESC(dma_entry_limit,
++               "Maximum number of user DMA mappings per container (65535).");
++
+ struct vfio_iommu {
+       struct list_head        domain_list;
+       struct mutex            lock;
+       struct rb_root          dma_list;
++      unsigned int            dma_avail;
+       bool                    v2;
+       bool                    nesting;
+ };
+@@ -382,6 +388,7 @@ static void vfio_remove_dma(struct vfio_
+       vfio_unmap_unpin(iommu, dma);
+       vfio_unlink_dma(iommu, dma);
+       kfree(dma);
++      iommu->dma_avail++;
+ }
+ 
+ static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
+@@ -582,12 +589,18 @@ static int vfio_dma_do_map(struct vfio_i
+               return -EEXIST;
+       }
+ 
++      if (!iommu->dma_avail) {
++              mutex_unlock(&iommu->lock);
++              return -ENOSPC;
++      }
++
+       dma = kzalloc(sizeof(*dma), GFP_KERNEL);
+       if (!dma) {
+               mutex_unlock(&iommu->lock);
+               return -ENOMEM;
+       }
+ 
++      iommu->dma_avail--;
+       dma->iova = iova;
+       dma->vaddr = vaddr;
+       dma->prot = prot;
+@@ -903,6 +916,7 @@ static void *vfio_iommu_type1_open(unsig
+ 
+       INIT_LIST_HEAD(&iommu->domain_list);
+       iommu->dma_list = RB_ROOT;
++      iommu->dma_avail = dma_entry_limit;
+       mutex_init(&iommu->lock);
+ 
+       return iommu;