linux-kernel - [PATCH 1/4] iommu/vt-d: IOMMU Page Request needs to check if address is canonical.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  8 Aug 2017 13:22:18 -0700
From:   Ashok Raj <ashok.raj@...el.com>
To:     linux-kernel@...r.kernel.org, Joerg Roedel <joro@...tes.org>
Cc:     Ashok Raj <ashok.raj@...el.com>, Huang Ying <ying.huang@...el.com>,
        Dave Hansen <dave.hansen@...el.com>,
        iommu@...ts-foundation.org, David Woodhouse <dwmw2@...radead.org>,
        Jacob Pan <jacob.jun.pan@...el.com>
Subject: [PATCH 1/4] iommu/vt-d: IOMMU Page Request needs to check if address is canonical.

Page Request from devices that support device-tlb would request translation
to pre-cache them in device to avoid overhead of IOMMU lookups.

IOMMU needs to check for canonicallity of the address before performing
page-fault processing.

To: Joerg Roedel <joro@...tes.org>
To: linux-kernel@...r.kernel.org>
Cc: iommu@...ts-foundation.org
Cc: David Woodhouse <dwmw2@...radead.org>
Cc: Jacob Pan <jacob.jun.pan@...el.com>
Cc: Ashok Raj <ashok.raj@...el.com>

Signed-off-by: Ashok Raj <ashok.raj@...el.com>
Reported-by: Sudeep Dutt <sudeep.dutt@...el.com>
---
 drivers/iommu/intel-svm.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index f167c0d..0c9f077 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -24,6 +24,7 @@
 #include <linux/pci-ats.h>
 #include <linux/dmar.h>
 #include <linux/interrupt.h>
+#include <asm/page.h>
 
 static irqreturn_t prq_event_thread(int irq, void *d);
 
@@ -555,6 +556,14 @@ static bool access_error(struct vm_area_struct *vma, struct page_req_dsc *req)
 	return (requested & ~vma->vm_flags) != 0;
 }
 
+static bool is_canonical_address(u64 addr)
+{
+	int shift = 64 - (__VIRTUAL_MASK_SHIFT + 1);
+	long saddr = (long) addr;
+
+	return (((saddr << shift) >> shift) == saddr);
+}
+
 static irqreturn_t prq_event_thread(int irq, void *d)
 {
 	struct intel_iommu *iommu = d;
@@ -612,6 +621,11 @@ static irqreturn_t prq_event_thread(int irq, void *d)
 		/* If the mm is already defunct, don't handle faults. */
 		if (!mmget_not_zero(svm->mm))
 			goto bad_req;
+
+		/* If address is not canonical, return invalid response */
+		if (!is_canonical_address(address))
+			goto bad_req;
+
 		down_read(&svm->mm->mmap_sem);
 		vma = find_extend_vma(svm->mm, address);
 		if (!vma || address < vma->vm_start)
-- 
2.7.4