search for: e6d6dd6c875

When running a guest featuring a virtio-blk-pci protected with a virtual IOMMU we hit a NULL pointer dereference. This series removes the dma_max_mapping_size() call in virtio_max_dma_size when the device does not have any dma_mask set. A check is also added to early return in dma_addressing_limited() if the dma_mask is NULL. Eric Auger (2): dma-mapping: Protect dma_addressing_limited against

...n Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at redhat.com> > Suggested-by: Christoph Hellwig <hch at lst.de> Christoph, I wonder why did you suggest this? The connection between dma_mask and dma_max_mapping_size is far from obvio...

...n Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at redhat.com> > Suggested-by: Christoph Hellwig <hch at lst.de> Christoph, I wonder why did you suggest this? The connection between dma_mask and dma_max_mapping_size is far from obvio...

...-> implicit convert err = virtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX, struct virtio_blk_config, size_max, &v); max_size = min(max_size, v); There is a risk during implicit convert here, once virtio_max_dma_size returns 4G, max_size becomes 0. Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") Cc: Joerg Roedel <jroedel at suse.de> Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/virtio/virtio_ring.c | 12 ++++++++---- include/linux/virtio.h | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-)...

...virtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX, > struct virtio_blk_config, size_max, &v); > max_size = min(max_size, v); > > There is a risk during implicit convert here, once virtio_max_dma_size > returns 4G, max_size becomes 0. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Cc: Joerg Roedel <jroedel at suse.de> > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> > --- > drivers/virtio/virtio_ring.c | 12 ++++++++---- > include/linux/virtio.h | 2 +- > 2 files changed, 9...

...n Mon, Jul 22, 2019 at 04:55:09PM +0200, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at redhat.com> > Suggested-by: Christoph Hellwig <hch at lst.de> Looks good. virtio maintainers, let me know if you want to queue it up or if I should pick the patch up through the dma...

...rtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX, > struct virtio_blk_config, size_max, &v); > max_size = min(max_size, v); > > There is a risk during implicit convert here, once virtio_max_dma_size > returns 4G, max_size becomes 0. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Cc: Joerg Roedel <jroedel at suse.de> > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> is this a theoretical concern or do you manage to trigger this somehow? > --- > drivers/virtio/virtio_ring.c | 12 +++++...

...rtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX, > struct virtio_blk_config, size_max, &v); > max_size = min(max_size, v); > > There is a risk during implicit convert here, once virtio_max_dma_size > returns 4G, max_size becomes 0. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Cc: Joerg Roedel <jroedel at suse.de> > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> > --- > drivers/virtio/virtio_ring.c | 12 ++++++++---- > include/linux/virtio.h | 2 +- > 2 files changed, 9...

...LK_F_SIZE_MAX, > > struct virtio_blk_config, size_max, &v); > > max_size = min(max_size, v); > > > > There is a risk during implicit convert here, once virtio_max_dma_size > > returns 4G, max_size becomes 0. > > > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > > Cc: Joerg Roedel <jroedel at suse.de> > > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> > > --- > > drivers/virtio/virtio_ring.c | 12 ++++++++---- > > include/linux/virtio.h | 2 +-...

...struct virtio_blk_config, size_max, &v); > > > max_size = min(max_size, v); > > > > > > There is a risk during implicit convert here, once virtio_max_dma_size > > > returns 4G, max_size becomes 0. > > > > > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > > > Cc: Joerg Roedel <jroedel at suse.de> > > > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> > > > --- > > > drivers/virtio/virtio_ring.c | 12 ++++++++---- > > > include/lin...

On 22/07/2019 15:55, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at redhat.com> > Suggested-by: Christoph Hellwig <hch at lst.de> > --- > drivers/virtio/virtio_ring.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff...

On 22/07/2019 15:55, Eric Auger wrote: > Do not call dma_max_mapping_size for devices that have no DMA > mask set, otherwise we can hit a NULL pointer dereference. > > This occurs when a virtio-blk-pci device is protected with > a virtual IOMMU. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Signed-off-by: Eric Auger <eric.auger at redhat.com> > Suggested-by: Christoph Hellwig <hch at lst.de> > --- > drivers/virtio/virtio_ring.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff...

Do not call dma_max_mapping_size for devices that have no DMA mask set, otherwise we can hit a NULL pointer dereference. This occurs when a virtio-blk-pci device is protected with a virtual IOMMU. Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") Signed-off-by: Eric Auger <eric.auger at redhat.com> Suggested-by: Christoph Hellwig <hch at lst.de> --- drivers/virtio/virtio_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/virtio/virtio_ring.c...

...0200, Eric Auger wrote: > > Do not call dma_max_mapping_size for devices that have no DMA > > mask set, otherwise we can hit a NULL pointer dereference. > > > > This occurs when a virtio-blk-pci device is protected with > > a virtual IOMMU. > > > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > > Signed-off-by: Eric Auger <eric.auger at redhat.com> > > Suggested-by: Christoph Hellwig <hch at lst.de> > > Christoph, I wonder why did you suggest this? > The connection between dma_mask and dma_max_mappi...