linux-kernel - [PATCH] iommu/vt-d: check alignment before using psi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Mar 2022 14:07:11 +0900
From:   David Stevens <stevensd@...omium.org>
To:     Lu Baolu <baolu.lu@...ux.intel.com>
Cc:     iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
        David Stevens <stevensd@...omium.org>
Subject: [PATCH] iommu/vt-d: check alignment before using psi

From: David Stevens <stevensd@...omium.org>

Fall back to domain selective flush if the target address is not aligned
to the mask being used for invalidation. This is necessary because page
selective invalidation masks out the lower order bits of the target
address based on the mask value, so if a non-aligned address is targeted
for psi, then mappings at the end of [pfn, pfn+pages) may not properly
be flushed from the iotlb.

This is not normally an issue because iova.c always allocates iovas that
are aligned to their size. However, iovas which come from other sources
(e.g. userspace via VFIO) may not be aligned.

Signed-off-by: David Stevens <stevensd@...omium.org>
---
 drivers/iommu/intel/iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 5b196cfe9ed2..c122686e0a5c 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -1735,7 +1735,8 @@ static void iommu_flush_iotlb_psi(struct intel_iommu *iommu,
 		 * and the base address is naturally aligned to the size.
 		 */
 		if (!cap_pgsel_inv(iommu->cap) ||
-		    mask > cap_max_amask_val(iommu->cap))
+		    mask > cap_max_amask_val(iommu->cap) ||
+		    unlikely(((1 << mask) - 1) & pfn))
 			iommu->flush.flush_iotlb(iommu, did, 0, 0,
 							DMA_TLB_DSI_FLUSH);
 		else
-- 
2.35.1.723.g4982287a31-goog