lkml.org 
[lkml]   [2018]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 018/235] iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>

    [ Upstream commit 29859aeb8a6ea17ba207933a81b6b77b4d4df81a ]

    When run on a 64-bit system in selftest, the v7s driver may obtain page
    table with physical addresses larger than 32-bit. Level-2 tables are 1KB
    and are are allocated with slab, which doesn't accept the GFP_DMA32
    flag. Currently map() truncates the address written in the PTE, causing
    iova_to_phys() or unmap() to access invalid memory. Kasan reports it as
    a use-after-free. To avoid any nasty surprise, test if the physical
    address fits in a PTE before returning a new table. 32-bit systems,
    which are the main users of this page table format, shouldn't see any
    difference.

    Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/iommu/io-pgtable-arm-v7s.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/drivers/iommu/io-pgtable-arm-v7s.c
    +++ b/drivers/iommu/io-pgtable-arm-v7s.c
    @@ -192,6 +192,7 @@ static void *__arm_v7s_alloc_table(int l
    {
    struct io_pgtable_cfg *cfg = &data->iop.cfg;
    struct device *dev = cfg->iommu_dev;
    + phys_addr_t phys;
    dma_addr_t dma;
    size_t size = ARM_V7S_TABLE_SIZE(lvl);
    void *table = NULL;
    @@ -200,6 +201,10 @@ static void *__arm_v7s_alloc_table(int l
    table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size));
    else if (lvl == 2)
    table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA);
    + phys = virt_to_phys(table);
    + if (phys != (arm_v7s_iopte)phys)
    + /* Doesn't fit in PTE */
    + goto out_free;
    if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) {
    dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
    if (dma_mapping_error(dev, dma))
    @@ -209,7 +214,7 @@ static void *__arm_v7s_alloc_table(int l
    * address directly, so if the DMA layer suggests otherwise by
    * translating or truncating them, that bodes very badly...
    */
    - if (dma != virt_to_phys(table))
    + if (dma != phys)
    goto out_unmap;
    }
    kmemleak_ignore(table);

    \
     
     \ /
      Last update: 2018-09-24 14:52    [W:6.098 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site