linux-kernel - [PATCH] iommu/vt-d: Fix a bug in intel_iommu_iova_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20200219193221.19799-1-yonghyun@google.com>
Date:   Wed, 19 Feb 2020 11:32:21 -0800
From:   Yonghyun Hwang <yonghyun@...gle.com>
To:     David Woodhouse <dwmw2@...radead.org>,
        Lu Baolu <baolu.lu@...ux.intel.com>,
        Joerg Roedel <joro@...tes.org>
Cc:     iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
        Havard Skinnemoen <hskinnemoen@...gle.com>,
        Deepa Dinamani <deepadinamani@...gle.com>,
        Moritz Fischer <mdf@...nel.org>,
        Yonghyun Hwang <yonghyun@...gle.com>
Subject: [PATCH] iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page

intel_iommu_iova_to_phys() has a bug when it translates an IOVA for a huge
page onto its corresponding physical address. This commit fixes the bug by
accomodating the level of page entry for the IOVA and adds IOVA's lower
address to the physical address.

Signed-off-by: Yonghyun Hwang <yonghyun@...gle.com>
---
 drivers/iommu/intel-iommu.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 0c8d81f56a30..beff7ede41f4 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -5548,6 +5548,15 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain,
 	return size;
 }
 
+static inline unsigned long pfn_level_mask(unsigned long pfn, int level)
+{
+	if (level > 1)
+		return pfn & (BIT_MASK(level_to_offset_bits(level)) - 1)
+			<< VTD_PAGE_SHIFT;
+	else
+		return 0;
+}
+
 static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
 					    dma_addr_t iova)
 {
@@ -5555,13 +5564,15 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
 	struct dma_pte *pte;
 	int level = 0;
 	u64 phys = 0;
+	const unsigned long pfn = iova >> VTD_PAGE_SHIFT;
 
 	if (dmar_domain->flags & DOMAIN_FLAG_LOSE_CHILDREN)
 		return 0;
 
-	pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level);
+	pte = pfn_to_dma_pte(dmar_domain, pfn, &level);
 	if (pte)
-		phys = dma_pte_addr(pte);
+		phys = dma_pte_addr(pte) + pfn_level_mask(pfn, level) +
+			(iova & ~VTD_PAGE_MASK);
 
 	return phys;
 }
-- 
2.25.0.265.gbab2e86ba0-goog