• Alexey Kardashevskiy's avatar
    KVM: PPC: Check if IOMMU page is contained in the pinned physical page · 76fa4975
    Alexey Kardashevskiy authored
    A VM which has:
     - a DMA capable device passed through to it (eg. network card);
     - running a malicious kernel that ignores H_PUT_TCE failure;
     - capability of using IOMMU pages bigger that physical pages
    can create an IOMMU mapping that exposes (for example) 16MB of
    the host physical memory to the device when only 64K was allocated to the VM.
    
    The remaining 16MB - 64K will be some other content of host memory, possibly
    including pages of the VM, but also pages of host kernel memory, host
    programs or other VMs.
    
    The attacking VM does not control the location of the page it can map,
    and is only allowed to map as many pages as it has pages of RAM.
    
    We already have a check in drivers/vfio/vfio_iommu_spapr_tce.c that
    an IOMMU page is contained in the physical page so the PCI hardware won't
    get access to unassigned host memory; however this check is missing in
    the KVM fastpath (H_PUT_TCE accelerated code). We were lucky so far and
    did not hit this yet as the very first time when the mapping happens
    we do not have tbl::it_userspace allocated yet and fall back to
    the userspace which in turn calls VFIO IOMMU driver, this fails and
    the guest does not retry,
    
    This stores the smallest preregistered page size in the preregistered
    region descriptor and changes the mm_iommu_xxx API to check this against
    the IOMMU page size.
    
    This calculates maximum page size as a minimum of the natural region
    alignment and compound page size. For the page shift this uses the shift
    returned by find_linux_pte() which indicates how the page is mapped to
    the current userspace - if the page is huge and this is not a zero, then
    it is a leaf pte and the page is mapped within the range.
    
    Fixes: 121f80ba ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
    Cc: stable@vger.kernel.org # v4.12+
    Signed-off-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
    Reviewed-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    76fa4975
mmu_context_iommu.c 9.84 KB