From patchwork Thu Jan 19 17:06:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Shishkin X-Patchwork-Id: 45871 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp446823wrn; Thu, 19 Jan 2023 09:16:21 -0800 (PST) X-Google-Smtp-Source: AMrXdXsgig5YIS/n49O7ZH6BmJ8CyLgJR2ZwP1PYrZhlmTHC2zIvjhtFn1bMQOqgVh+Dj14p9BEP X-Received: by 2002:a17:907:c606:b0:870:d9a:9ebb with SMTP id ud6-20020a170907c60600b008700d9a9ebbmr8306348ejc.38.1674148581510; Thu, 19 Jan 2023 09:16:21 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674148581; cv=none; d=google.com; s=arc-20160816; b=a/D20SEELpOFB8iEPaDPocxT3PBxQntW9TSU0zD8tcQ3jrcgOcJ9+HRbO2P7iyzNxw +7+TwIQvwrxTBFZlymTvOKsorl2a1fB88eaokfoSKVxKjtgeqgWf63SfozXoyNKHbUGr Lkrvf+Ia3ZZDWOHcMr9UJvpIsDslHOWURp1Uv4ige4/2cJ6+ofVZVO84kwsL1ch+J0i/ dMjluAauK0C5U3qcal8TzNBJ45BWm/+BICVEV4JPO80EyWmt+Whf4IvkLkHUgWXpmKQK 39QkkfAiXCyRtJl/R7PszXcuIsKZKhS5PWg6YoQu9O0ek9qhe902NViqtYKkFRYPUk+h SH4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=bQipJj8eF9do85wBXhdSWSe/f855wHzm81YZ6Tb7gzw=; b=TKjWnDcXkVYnZCce8AEWnNwd4lo+wn60ACux8VqEk/puNctyBSnM6r50X/DPLFnOR3 SlZVolsQmOthWcackNx62wLfwhvpolVjoDhJJ31B+36aA5G6cngwi0iwgA+PdLk5GKFj W5oHaFjmUAPH9apiexS4Br3+zX+NE7X8brZiMOCWiXdV/x0LbK9WUsHxd3BCgHNhPHpq 4UyePd9jXsS1TmIBJzWHpcTPrEq4p1K/Gvd4s/wxfM8Av8WZtBhQx4KvGG/ustPyderE cm4gkuc6kfkGx+3dYjVBfxTzEho0NyWdAL4kujPhZpvuxqjlYllhXjeSsBqhlFjU/HS7 6IFg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=cJuffKRZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d14-20020aa7d5ce000000b0049b63678b52si16507844eds.516.2023.01.19.09.15.57; Thu, 19 Jan 2023 09:16:21 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=cJuffKRZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230073AbjASRKx (ORCPT + 99 others); Thu, 19 Jan 2023 12:10:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229915AbjASRKu (ORCPT ); Thu, 19 Jan 2023 12:10:50 -0500 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C736E5B91; Thu, 19 Jan 2023 09:10:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1674148247; x=1705684247; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=WZXENZe/rH7FLxenBxCcqTEtaplqgNUH7FpDX/thmSk=; b=cJuffKRZyiNr4wZK0xBT/+6tqIBnxjiVOF/2B7Tu105zHva4SDcq5Xqp I/1rkZ7+6StkYjcpQlkfKVUseuFpjGsdyTGXKfG1QLTnmIGKXIPTyoE25 t2nAN0QrNPy09svIf0jbR43uMQ9eAcEJZ0GryjTvXctFYYbh+kuHQ+ilT dmR6MIb5vph8mkGAE/VebqNKiHmZe8rlesSMqUZhYVZZHZSzoupbTzwiq u5vnXRsnEAum6XwMLv99xAi2ZCuJn2lZ70D9h9mAoU1gBXBtCh2YNcQaz PFWV94qvUrCkTUlfgNUM73alvYUXqy3Cl/cmNnG+UjlqyH1EELT7eGh2w Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10595"; a="305714674" X-IronPort-AV: E=Sophos;i="5.97,229,1669104000"; d="scan'208";a="305714674" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Jan 2023 09:06:20 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10595"; a="784124771" X-IronPort-AV: E=Sophos;i="5.97,229,1669104000"; d="scan'208";a="784124771" Received: from black.fi.intel.com (HELO black.fi.intel.com.) ([10.237.72.28]) by orsmga004.jf.intel.com with ESMTP; 19 Jan 2023 09:06:16 -0800 From: Alexander Shishkin To: Bjorn Helgaas , Thomas Gleixner , linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Marc Zyngier , darwi@linutronix.de, elena.reshetova@intel.com, kirill.shutemov@linux.intel.com, Alexander Shishkin , Mika Westerberg , stable@vger.kernel.org Subject: [PATCH 1/2] PCI/MSI: Cache the MSIX table size Date: Thu, 19 Jan 2023 19:06:32 +0200 Message-Id: <20230119170633.40944-2-alexander.shishkin@linux.intel.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> References: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755472022906670901?= X-GMAIL-MSGID: =?utf-8?q?1755472022906670901?= A malicious device can change its MSIX table size between the table ioremap() and subsequent accesses, resulting in a kernel page fault in pci_write_msg_msix(). To avoid this, cache the table size observed at the moment of table ioremap() and use the cached value. This, however, does not help drivers that peek at the PCIE_MSIX_FLAGS register directly. Signed-off-by: Alexander Shishkin Reviewed-by: Mika Westerberg Cc: stable@vger.kernel.org --- drivers/pci/msi/api.c | 7 ++++++- drivers/pci/msi/msi.c | 2 +- include/linux/pci.h | 1 + 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/api.c b/drivers/pci/msi/api.c index b8009aa11f3c..617ea1256487 100644 --- a/drivers/pci/msi/api.c +++ b/drivers/pci/msi/api.c @@ -75,8 +75,13 @@ int pci_msix_vec_count(struct pci_dev *dev) if (!dev->msix_cap) return -EINVAL; + if (dev->flags_qsize) + return dev->flags_qsize; + pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control); - return msix_table_size(control); + dev->flags_qsize = msix_table_size(control); + + return dev->flags_qsize; } EXPORT_SYMBOL(pci_msix_vec_count); diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index 1f716624ca56..d50cd45119f1 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -715,7 +715,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control); /* Request & Map MSI-X table region */ - tsize = msix_table_size(control); + tsize = pci_msix_vec_count(dev); dev->msix_base = msix_map_region(dev, tsize); if (!dev->msix_base) { ret = -ENOMEM; diff --git a/include/linux/pci.h b/include/linux/pci.h index adffd65e84b4..2e1a72a2139d 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -352,6 +352,7 @@ struct pci_dev { u8 rom_base_reg; /* Config register controlling ROM */ u8 pin; /* Interrupt pin this device uses */ u16 pcie_flags_reg; /* Cached PCIe Capabilities Register */ + u16 flags_qsize; /* Cached MSIX table size */ unsigned long *dma_alias_mask;/* Mask of enabled devfn aliases */ struct pci_driver *driver; /* Driver bound to this device */ From patchwork Thu Jan 19 17:06:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Alexander Shishkin X-Patchwork-Id: 45872 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp447183wrn; Thu, 19 Jan 2023 09:17:04 -0800 (PST) X-Google-Smtp-Source: AMrXdXuXM3LETwZy6dKMBsWuXygLpnOzpPjpt4hNg+CnAmevdBttaqevD8zuORKrkYRBZ4Ov4+/n X-Received: by 2002:aa7:db8b:0:b0:49b:b274:b816 with SMTP id u11-20020aa7db8b000000b0049bb274b816mr12375093edt.37.1674148624704; Thu, 19 Jan 2023 09:17:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674148624; cv=none; d=google.com; s=arc-20160816; b=c2orC1Yzkg3POCb05FdBHXLB+TJItpop/zPMYLRINpZ3Je5fIDcMbsJWq/EH5e/PqZ w1JMGjN40ORPPaMc4et9Mn+VNtGFCKb2mN5s6BlbX8Ww97uEWC5WvOYUy0uW1FHQygmZ xoMfJWBtAJJjKs9oqnnO6GqcP5oHyNpd8le44zIUnX0cD5QuVfHuRo/3+QCkjj2Uodv3 oTPiintB0//IPeW9RRxZKiSO/HD13FKzIGrO8tjEFh3DWPv4S/O+1Bl8htgE/j6HLBw9 v81uhChj5SwJFmZfrWMIfckyvHKHgS9t0CxfyEOAVrBJoZgvjqujGKkjTKnumnjm5vcI LkEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=WTrvkt2rrdMyUpR8FRLRv2haTGVJ8sDYJsf7qIoceDQ=; b=JB199o+H+aerpH4yfziNDsnLdcKgbalx3lksdIc2qoMsSPNMSPNN+fPzF8z5pibqsr 4WaRw8VMMYqORkU94RgH+m0yrzc890laCmTuFOXrU/oRnsNpHzCoxD3D7BkpXlwFZs45 EzAmoUT0Ue0ogrQPoexFoVLqvEJ6N70qxXK+dOb9qqnoyjdIRzbUgmO0U/SNgRxv9KwC M9i2xmhuGvlnPvuK8wt6vSsC7FsLI6w0jEVuO3SEFoPZnW9LMVBeb+7VW5C+E/ZTWwJR pk2WBG/E/AD+RtUaAcjrrh9jLIpfMpcigP9gEiCOG68SCC8q9WhZ/cGtJNWLbuKjgghA gbqw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=imGN8q9g; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id dm17-20020a170907949100b00871d5ec9072si11752773ejc.907.2023.01.19.09.16.28; Thu, 19 Jan 2023 09:17:04 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=imGN8q9g; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230126AbjASRKz (ORCPT + 99 others); Thu, 19 Jan 2023 12:10:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54244 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229784AbjASRKv (ORCPT ); Thu, 19 Jan 2023 12:10:51 -0500 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D83EFA5CB; Thu, 19 Jan 2023 09:10:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1674148248; x=1705684248; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=a1Xl5AI0jRujcTSH5TR69MwUM/ZMR3gvrCrzmKfX45M=; b=imGN8q9gbYCE0bDV8Q8VgIm/UqwL/J2OUkx9ZBaWKy/iUlVANbR+Wj/l CWDDPZ3niEk15VBBx/zP8+TDoy3nFyTLimIWj9u+ro8lOvRE2OOjEzj1L YEnYMUUCBV4atn6J7h/evUNa6Mo1HUwz5LBn6eL4BJzIDSr6UGPb+Kzn6 LPF/IMVuFgv9Wj7pc8u+bNeZbAPjn6sbMZggtL7RZK7gks+9A1pwKa+29 cwVHYhWPOuUv6b4dKy9Wvuj/dnk/Dj3mMHf1YqwVoqpqME4Kg6q8IK4oC 1RLhnUoZbmYFYNA6dpV4MJXLrbtriumNegsCBGnffZQaSip5Tc/3PTxZc g==; X-IronPort-AV: E=McAfee;i="6500,9779,10595"; a="305714699" X-IronPort-AV: E=Sophos;i="5.97,229,1669104000"; d="scan'208";a="305714699" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Jan 2023 09:06:23 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10595"; a="784124777" X-IronPort-AV: E=Sophos;i="5.97,229,1669104000"; d="scan'208";a="784124777" Received: from black.fi.intel.com (HELO black.fi.intel.com.) ([10.237.72.28]) by orsmga004.jf.intel.com with ESMTP; 19 Jan 2023 09:06:20 -0800 From: Alexander Shishkin To: Bjorn Helgaas , Thomas Gleixner , linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Marc Zyngier , darwi@linutronix.de, elena.reshetova@intel.com, kirill.shutemov@linux.intel.com, Alexander Shishkin , Mika Westerberg , =?utf-8?q?Ilpo_J=C3=A4rv?= =?utf-8?q?inen?= , stable@vger.kernel.org Subject: [PATCH 2/2] PCI/MSI: Validate device supplied MSI table offset and size Date: Thu, 19 Jan 2023 19:06:33 +0200 Message-Id: <20230119170633.40944-3-alexander.shishkin@linux.intel.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> References: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755472068303262195?= X-GMAIL-MSGID: =?utf-8?q?1755472068303262195?= Currently, the MSI table offset supplied by device's config space is passed directly into ioremap() without validation, allowing, for example, a malicious VMM to trick the OS into exposing its private memory. Correct this by making sure the table with the given number of vectors fits into its BIR starting at the provided table offset. Signed-off-by: Alexander Shishkin Reported-by: Elena Reshetova Reviewed-by: Mika Westerberg Reviewed-by: Ilpo Järvinen Cc: stable@vger.kernel.org --- drivers/pci/msi/msi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index d50cd45119f1..e93e633cb6a3 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -552,7 +552,8 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned int nr_entries) { resource_size_t phys_addr; - u32 table_offset; + u32 table_offset, table_size; + resource_size_t bir_size; unsigned long flags; u8 bir; @@ -563,10 +564,15 @@ static void __iomem *msix_map_region(struct pci_dev *dev, if (!flags || (flags & IORESOURCE_UNSET)) return NULL; + bir_size = pci_resource_len(dev, bir); + table_size = nr_entries * PCI_MSIX_ENTRY_SIZE; table_offset &= PCI_MSIX_TABLE_OFFSET; + if (bir_size < table_size || table_offset > bir_size - table_size) + return NULL; + phys_addr = pci_resource_start(dev, bir) + table_offset; - return ioremap(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE); + return ioremap(phys_addr, table_size); } /**