follow_pfn() doesn't make sure that we're using the correct page
protections, get the pte with follow_pte() so that we can test
protections and get the pfn from the pte.
Fixes: 5cbf3264bc71 ("vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()")
Signed-off-by: Alex Williamson <[email protected]>
---
drivers/vfio/vfio_iommu_type1.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index ec9fd95a138b..90715413c3d9 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -463,9 +463,11 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
unsigned long vaddr, unsigned long *pfn,
bool write_fault)
{
+ pte_t *ptep;
+ spinlock_t *ptl;
int ret;
- ret = follow_pfn(vma, vaddr, pfn);
+ ret = follow_pte(vma->vm_mm, vaddr, NULL, &ptep, NULL, &ptl);
if (ret) {
bool unlocked = false;
@@ -479,9 +481,17 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
if (ret)
return ret;
- ret = follow_pfn(vma, vaddr, pfn);
+ ret = follow_pte(vma->vm_mm, vaddr, NULL, &ptep, NULL, &ptl);
+ if (ret)
+ return ret;
}
+ if (write_fault && !pte_write(*ptep))
+ ret = -EFAULT;
+ else
+ *pfn = pte_pfn(*ptep);
+
+ pte_unmap_unlock(ptep, ptl);
return ret;
}
On Fri, Feb 12, 2021 at 12:01:50PM -0700, Alex Williamson wrote:
> follow_pfn() doesn't make sure that we're using the correct page
> protections, get the pte with follow_pte() so that we can test
> protections and get the pfn from the pte.
>
> Fixes: 5cbf3264bc71 ("vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()")
> Signed-off-by: Alex Williamson <[email protected]>
> ---
> drivers/vfio/vfio_iommu_type1.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index ec9fd95a138b..90715413c3d9 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -463,9 +463,11 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
> unsigned long vaddr, unsigned long *pfn,
> bool write_fault)
> {
> + pte_t *ptep;
> + spinlock_t *ptl;
> int ret;
>
> - ret = follow_pfn(vma, vaddr, pfn);
> + ret = follow_pte(vma->vm_mm, vaddr, NULL, &ptep, NULL, &ptl);
> if (ret) {
> bool unlocked = false;
>
> @@ -479,9 +481,17 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
> if (ret)
> return ret;
>
> - ret = follow_pfn(vma, vaddr, pfn);
> + ret = follow_pte(vma->vm_mm, vaddr, NULL, &ptep, NULL, &ptl);
commit 9fd6dad1261a541b3f5fa7dc5b152222306e6702 in linux-next is what
export's follow_pte and it uses a different signature:
+int follow_pte(struct mm_struct *mm, unsigned long address,
+ pte_t **ptepp, spinlock_t **ptlp)
Recommend you send this patch for rc1 once the right stuff lands in
Linus's tree
Otherwise it looks OK
Reviewed-by: Jason Gunthorpe <[email protected]>
Jason
On Fri, 12 Feb 2021 15:08:51 -0400
Jason Gunthorpe <[email protected]> wrote:
> On Fri, Feb 12, 2021 at 12:01:50PM -0700, Alex Williamson wrote:
> > follow_pfn() doesn't make sure that we're using the correct page
> > protections, get the pte with follow_pte() so that we can test
> > protections and get the pfn from the pte.
> >
> > Fixes: 5cbf3264bc71 ("vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()")
> > Signed-off-by: Alex Williamson <[email protected]>
> > ---
> > drivers/vfio/vfio_iommu_type1.c | 14 ++++++++++++--
> > 1 file changed, 12 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> > index ec9fd95a138b..90715413c3d9 100644
> > --- a/drivers/vfio/vfio_iommu_type1.c
> > +++ b/drivers/vfio/vfio_iommu_type1.c
> > @@ -463,9 +463,11 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
> > unsigned long vaddr, unsigned long *pfn,
> > bool write_fault)
> > {
> > + pte_t *ptep;
> > + spinlock_t *ptl;
> > int ret;
> >
> > - ret = follow_pfn(vma, vaddr, pfn);
> > + ret = follow_pte(vma->vm_mm, vaddr, NULL, &ptep, NULL, &ptl);
> > if (ret) {
> > bool unlocked = false;
> >
> > @@ -479,9 +481,17 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
> > if (ret)
> > return ret;
> >
> > - ret = follow_pfn(vma, vaddr, pfn);
> > + ret = follow_pte(vma->vm_mm, vaddr, NULL, &ptep, NULL, &ptl);
>
> commit 9fd6dad1261a541b3f5fa7dc5b152222306e6702 in linux-next is what
> export's follow_pte and it uses a different signature:
>
> +int follow_pte(struct mm_struct *mm, unsigned long address,
> + pte_t **ptepp, spinlock_t **ptlp)
Thanks, I stole it off the mailing list and hadn't noticed the change.
> Recommend you send this patch for rc1 once the right stuff lands in
> Linus's tree
>
> Otherwise it looks OK
>
> Reviewed-by: Jason Gunthorpe <[email protected]>
Thanks!
Alex
Hi Alex,
I love your patch! Yet something to improve:
[auto build test ERROR on vfio/next]
[also build test ERROR on v5.11-rc7 next-20210211]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Alex-Williamson/vfio-type1-Use-follow_pte/20210213-030541
base: https://github.com/awilliam/linux-vfio.git next
config: i386-randconfig-a002-20210209 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/d1aea3bcf226e5225e706acb7df2f4c68ea8858a
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Alex-Williamson/vfio-type1-Use-follow_pte/20210213-030541
git checkout d1aea3bcf226e5225e706acb7df2f4c68ea8858a
# save the attached .config to linux build tree
make W=1 ARCH=i386
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
All errors (new ones prefixed by >>):
In file included from include/linux/mm.h:33,
from include/linux/scatterlist.h:8,
from include/linux/iommu.h:10,
from drivers/vfio/vfio_iommu_type1.c:27:
drivers/vfio/vfio_iommu_type1.c: In function 'follow_fault_pfn':
>> include/linux/pgtable.h:81:24: error: implicit declaration of function 'kunmap_atomic'; did you mean 'iommu_map_atomic'? [-Werror=implicit-function-declaration]
81 | #define pte_unmap(pte) kunmap_atomic((pte))
| ^~~~~~~~~~~~~
include/linux/mm.h:2231:2: note: in expansion of macro 'pte_unmap'
2231 | pte_unmap(pte); \
| ^~~~~~~~~
drivers/vfio/vfio_iommu_type1.c:494:2: note: in expansion of macro 'pte_unmap_unlock'
494 | pte_unmap_unlock(ptep, ptl);
| ^~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +81 include/linux/pgtable.h
974b9b2c68f3d3 Mike Rapoport 2020-06-08 76
974b9b2c68f3d3 Mike Rapoport 2020-06-08 77 #if defined(CONFIG_HIGHPTE)
974b9b2c68f3d3 Mike Rapoport 2020-06-08 78 #define pte_offset_map(dir, address) \
974b9b2c68f3d3 Mike Rapoport 2020-06-08 79 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
974b9b2c68f3d3 Mike Rapoport 2020-06-08 80 pte_index((address)))
974b9b2c68f3d3 Mike Rapoport 2020-06-08 @81 #define pte_unmap(pte) kunmap_atomic((pte))
974b9b2c68f3d3 Mike Rapoport 2020-06-08 82 #else
974b9b2c68f3d3 Mike Rapoport 2020-06-08 83 #define pte_offset_map(dir, address) pte_offset_kernel((dir), (address))
974b9b2c68f3d3 Mike Rapoport 2020-06-08 84 #define pte_unmap(pte) ((void)(pte)) /* NOP */
974b9b2c68f3d3 Mike Rapoport 2020-06-08 85 #endif
974b9b2c68f3d3 Mike Rapoport 2020-06-08 86
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]
Hi Alex,
I love your patch! Yet something to improve:
[auto build test ERROR on vfio/next]
[also build test ERROR on v5.11-rc7]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Alex-Williamson/vfio-type1-Use-follow_pte/20210213-030541
base: https://github.com/awilliam/linux-vfio.git next
config: x86_64-rhel (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/d1aea3bcf226e5225e706acb7df2f4c68ea8858a
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Alex-Williamson/vfio-type1-Use-follow_pte/20210213-030541
git checkout d1aea3bcf226e5225e706acb7df2f4c68ea8858a
# save the attached .config to linux build tree
make W=1 ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
All errors (new ones prefixed by >>, old ones prefixed by <<):
>> ERROR: modpost: "follow_pte" [drivers/vfio/vfio_iommu_type1.ko] undefined!
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]
On Fri, 12 Feb 2021 12:01:50 -0700
Alex Williamson <[email protected]> wrote:
> follow_pfn() doesn't make sure that we're using the correct page
> protections, get the pte with follow_pte() so that we can test
> protections and get the pfn from the pte.
>
> Fixes: 5cbf3264bc71 ("vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()")
> Signed-off-by: Alex Williamson <[email protected]>
> ---
> drivers/vfio/vfio_iommu_type1.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
With the function signature adapted:
Reviewed-by: Cornelia Huck <[email protected]>