Alex Williamson abafbc551f vfio-pci: Invalidate mmaps and block MMIO access on disabled memory ... Accessing the disabled memory space of a PCI device would typically result in a master abort response on conventional PCI, or an unsupported request on PCI express. The user would generally see these as a -1 response for the read return data and the write would be silently discarded, possibly with an uncorrected, non-fatal AER error triggered on the host. Some systems however take it upon themselves to bring down the entire system when they see something that might indicate a loss of data, such as this discarded write to a disabled memory space. To avoid this, we want to try to block the user from accessing memory spaces while they're disabled. We start with a semaphore around the memory enable bit, where writers modify the memory enable state and must be serialized, while readers make use of the memory region and can access in parallel. Writers include both direct manipulation via the command register, as well as any reset path where the internal mechanics of the reset may both explicitly and implicitly disable memory access, and manipulation of the MSI-X configuration, where the MSI-X vector table resides in MMIO space of the device. Readers include the read and write file ops to access the vfio device fd offsets as well as memory mapped access. In the latter case, we make use of our new vma list support to zap, or invalidate, those memory mappings in order to force them to be faulted back in on access. Our semaphore usage will stall user access to MMIO spaces across internal operations like reset, but the user might experience new behavior when trying to access the MMIO space while disabled via the PCI command register. Access via read or write while disabled will return -EIO and access via memory maps will result in a SIGBUS. This is expected to be compatible with known use cases and potentially provides better error handling capabilities than present in the hardware, while avoiding the more readily accessible and severe platform error responses that might otherwise occur. Fixes: CVE-2020-12888 Reviewed-by: Peter Xu <peterx@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>		2020-05-18 09:53:38 -06:00
..
accessibility	…
acpi	ACPI: EC: PM: Avoid premature returns from acpi_s2idle_wake()	2020-05-11 10:11:38 +02:00
amba	amba: Initialize dma_parms for amba devices	2020-04-28 17:44:34 +02:00
android	Merge 5.6-rc7 into char-misc-next	2020-03-23 07:59:38 +01:00
ata	ata: sata_inic162x fix a spelling issue	2020-04-23 09:59:30 -06:00
atm	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
auxdisplay	Merge 5.6-rc7 into char-misc-next	2020-03-23 07:59:38 +01:00
base	driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires	2020-04-28 17:57:13 +02:00
bcma	…
block	virtio-blk: handle block_device_operations callbacks after hot unplug	2020-05-02 10:28:13 -04:00
bluetooth	Bluetooth: btusb: print Intel fw build version in power-on boot	2020-03-16 08:57:40 +01:00
bus	bus: mhi: core: Fix channel device name conflict	2020-05-05 16:59:54 +02:00
cdrom	…
char	Convert i2c_new_device() to i2c_new_client_device()	2020-05-17 16:07:30 -07:00
clk	clk: ti: clkctrl: convert subclocks to use proper names also	2020-05-12 20:18:19 -07:00
clocksource	clocksource/drivers/timer-vf-pit: Add missing parenthesis	2020-04-05 09:24:58 +02:00
connector	…
counter	counter: 104-quad-8: Add lock guards - generic interface	2020-04-19 17:50:00 +01:00
cpufreq	cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once	2020-04-27 10:30:11 +02:00
cpuidle	Merge branch 'pm-cpuidle'	2020-04-10 11:32:22 +02:00
crypto	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-05-06 20:53:22 -07:00
dax	dax: Move mandatory ->zero_page_range() check in alloc_dax()	2020-04-02 19:15:03 -07:00
dca	…
devfreq	PM / devfreq: Fix handling dev_pm_qos_remove_request result	2020-03-25 08:35:03 +09:00
dio	…
dma	dmaengine: dmatest: Fix process hang when reading 'wait' parameter	2020-04-28 21:46:35 +05:30
dma-buf	dma-buf: fix documentation build warnings	2020-04-30 19:47:39 +05:30
edac	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-03-30 16:40:08 -07:00
eisa	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
extcon	Char/Misc driver patches for 5.7-rc1	2020-04-03 13:22:40 -07:00
firewire	…
firmware	gcc-10: mark more functions __init to avoid section mismatch warnings	2020-05-09 17:50:03 -07:00
fpga	fpga: dfl: pci: fix return value of cci_pci_sriov_configure	2020-03-30 20:45:30 -07:00
fsi	…
gnss	…
gpio	gpio: tegra: mask GPIO IRQs during IRQ shutdown	2020-04-28 16:22:33 +02:00
gpu	Just one meson patch this time to propagate an error code	2020-05-15 16:00:57 +10:00
greybus	…
hid	HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock	2020-05-04 11:24:58 +02:00
hsi	…
hv	hyperv-fixes for 5.7-rc4	2020-04-27 13:28:27 -07:00
hwmon	hwmon: (da9052) Synchronize access with mfd	2020-05-13 10:06:09 -07:00
hwspinlock	hwspinlock: hwspinlock_internal.h: Replace zero-length array with flexible-array member	2020-03-25 22:30:46 -07:00
hwtracing	intel_th: msu: Make stopping the trace optional	2020-03-24 13:45:24 +01:00
i2c	i2c: aspeed: Avoid i2c interrupt status clear race condition.	2020-04-30 16:12:33 +02:00
i3c	i3c: convert to use i2c_new_client_device()	2020-03-29 10:35:50 +02:00
ide	drivers/ide: Fix build regression.	2020-04-04 18:07:59 -07:00
idle	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-03-30 16:40:08 -07:00
iio	First set of IIO fixes for the 5.7 cycle.	2020-04-20 14:07:00 +02:00
infiniband	RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj	2020-05-12 17:02:25 -03:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2020-04-07 20:20:12 -07:00
interconnect	interconnect: qcom: Move the static keyword to the front of declaration	2020-04-29 13:11:44 +02:00
iommu	iommu/virtio: Reverse arguments to list_add	2020-05-08 17:31:18 +02:00
ipack	…
irqchip	Merge branch 'irq/gic-v4.1-fixes-5.7' into irq/irqchip-5.7	2020-04-17 08:59:55 +01:00
isdn	mISDN: make dmril and dmrim static	2020-04-16 13:52:31 -07:00
leds	leds: core: Fix warning message when init_data	2020-04-06 23:12:08 +02:00
lightnvm	for-5.7/drivers-2020-03-29	2020-03-30 11:43:51 -07:00
macintosh	Char/Misc driver patches for 5.7-rc1	2020-04-03 13:22:40 -07:00
mailbox	mailbox: imx: add SCU MU support	2020-03-19 23:04:32 -05:00
mcb	…
md	- Document DM integrity allow_discard feature that was added during	2020-04-30 16:45:08 -07:00
media	Power management updates for 5.7-rc1	2020-03-30 15:05:01 -07:00
memory	ARM: driver updates	2020-04-03 15:05:35 -07:00
memstick	…
message	scsi: message: fusion: Replace zero-length array with flexible-array member	2020-03-26 22:40:47 -04:00
mfd	mfd: intel-lpss: Fix Intel Elkhart Lake LPSS I2C input clock	2020-03-30 07:35:28 +01:00
misc	mei: me: disable mei interface on LBG servers.	2020-05-05 16:56:41 +02:00
mmc	mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040	2020-05-11 10:51:30 +02:00
most	most: core: use function subsys_initcall()	2020-04-28 15:04:09 +02:00
mtd	mtd: spi-nor: Compile files in controllers/ directory	2020-04-09 22:00:13 +02:00
mux	…
net	dpaa2-eth: properly handle buffer size restrictions	2020-05-15 10:30:47 -07:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-25 18:58:11 -07:00
ntb	pci-v5.7-changes	2020-04-03 14:25:02 -07:00
nubus	…
nvdimm	libnvdimm for 5.7	2020-04-08 21:03:40 -07:00
nvme	nvme-pci: dma read memory barrier for completions	2020-05-12 18:02:24 +02:00
nvmem	nvmem: core: remove nvmem_sysfs_get_groups()	2020-03-25 19:23:49 +01:00
of	of: unittest: kmemleak in duplicate property update	2020-04-17 08:31:34 -05:00
opp	opp: Manage empty OPP tables with clk handle	2020-04-13 16:14:55 +05:30
oprofile	…
parisc	parisc: Replace setup_irq() by request_irq()	2020-04-05 22:05:23 +02:00
parport	…
pci	PCI: Move Apex Edge TPU class quirk to fix BAR assignment	2020-04-14 19:16:51 -05:00
pcmcia	pcmcia: remove some unused space characters	2020-03-31 18:48:22 +02:00
perf	arm64 updates for 5.7:	2020-03-31 10:05:01 -07:00
phy	phy: qualcomm: usb-hs-28nm: Prepare clocks in init	2020-04-30 12:10:49 +05:30
pinctrl	pinctrl: qcom: Add affinity callbacks to msmgpio IRQ chip	2020-05-12 14:29:29 +02:00
platform	chrome-platform fixes for v5.7-rc5	2020-05-06 16:40:14 -07:00
pnp	…
power	change email address for Pali Rohár	2020-04-10 15:36:22 -07:00
powercap	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-03-30 16:40:08 -07:00
pps	…
ps3	powerpc/ps3: Remove an unneeded NULL check	2020-04-03 00:09:59 +11:00
ptp	ptp: Remove unneeded conversion to bool	2020-04-21 15:45:32 -07:00
pwm	pwm: pca9685: Fix PWM/GPIO inter-operation	2020-04-03 21:41:42 +02:00
rapidio	…
ras	…
regulator	regulator: Revert "Use driver_deferred_probe_timeout for regulator_init_complete_work"	2020-04-29 19:57:45 +02:00
remoteproc	remoteproc fixes for v5.7	2020-04-23 09:28:15 -07:00
reset	…
rpmsg	rpmsg: pull in slab.h	2020-04-17 06:05:29 -04:00
rtc	- New Drivers	2020-04-07 19:48:52 -07:00
s390	s390/ism: fix error return code in ism_probe()	2020-05-13 12:14:51 -07:00
sbus	misc: move FLASH_MINOR into miscdevice.h and fix conflicts	2020-03-18 12:27:04 +01:00
scsi	scsi: ibmvscsi: Fix WARN_ON during event pool release	2020-04-28 22:59:55 -04:00
sfi	…
sh	…
siox	…
slimbus	…
soc	arm64: soc: ZynqMP SoC fixes for v5.7	2020-04-21 14:21:20 +02:00
soundwire	Char/Misc driver patches for 5.7-rc1	2020-04-03 13:22:40 -07:00
spi	sound updates for 5.7-rc1	2020-04-02 15:50:04 -07:00
spmi	…
ssb	…
staging	staging: gasket: Check the return value of gasket_get_bar_index()	2020-05-05 12:36:05 +02:00
target	scsi: target/iblock: fix WRITE SAME zeroing	2020-04-22 00:02:13 -04:00
tc	…
tee	ARM: driver updates	2020-04-03 15:05:35 -07:00
thermal	- Convert tsens configuration DT binding to yaml (Rajeshwari)	2020-04-07 20:00:16 -07:00
thunderbolt	thunderbolt: Check return value of tb_sw_read() in usb4_switch_op()	2020-04-28 19:00:59 +02:00
tty	TTY/Serial fixes for 5.7-rc5	2020-05-08 08:56:16 -07:00
uio	uio: uio_pdrv_genirq: use new devm_uio_register_device() function	2020-03-18 12:34:10 +01:00
usb	USB: gadget: fix illegal array access in binding with UDC	2020-05-15 15:42:17 +02:00
vdpa	vhost: disable for OABI	2020-04-20 10:19:22 -04:00
vfio	vfio-pci: Invalidate mmaps and block MMIO access on disabled memory	2020-05-18 09:53:38 -06:00
vhost	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-05-06 20:53:22 -07:00
video	drm fixes for 5.7-rc1	2020-04-07 20:24:34 -07:00
virt	virt: vbox: Use fallthrough;	2020-03-19 07:41:03 +01:00
virtio	virtio-balloon: Avoid using the word 'report' when referring to free page hinting	2020-04-17 06:05:30 -04:00
visorbus	…
vlynq	…
vme	…
w1	…
watchdog	watchdog: sp805: fix restart handler	2020-04-08 11:18:38 +02:00
xen	xen: branch for v5.7-rc2	2020-04-17 10:35:17 -07:00
zorro	SPDX patches for 5.7-rc1.	2020-04-03 13:12:26 -07:00
Kconfig	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00
Makefile	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00