| Message ID | 160171933385.284610.10189082586063280867.stgit@bahia.lan |
|---|---|
| State | Superseded |
| Headers | show |
| Series | vhost: Skip access checks on GIOVAs | expand |
On 2020/10/3 下午6:02, Greg Kurz wrote: > When the IOTLB device is enabled, the log_guest_addr that is passed by > userspace to the VHOST_SET_VRING_ADDR ioctl, and which is then written > to vq->log_addr, is a GIOVA. All writes to this address are translated > by log_user() to writes to an HVA, and then ultimately logged through > the corresponding GPAs in log_write_hva(). No logging will ever occur > with vq->log_addr in this case. It is thus wrong to pass vq->log_addr > and log_guest_addr to log_access_vq() which assumes they are actual > GPAs. > > Introduce a new vq_log_used_access_ok() helper that only checks accesses > to the log for the used structure when there isn't an IOTLB device around. > > Signed-off-by: Greg Kurz <groug@kaod.org> Acked-by: Jason Wang <jasowang@redhat.com> In the future, we may consider to deprecate log_guest_addr since in any case regardless of IOTLB ennoblement we can get GPA from either IOTLB or MEM table. Thanks > --- > drivers/vhost/vhost.c | 23 ++++++++++++++++++----- > 1 file changed, 18 insertions(+), 5 deletions(-) > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index 9d2c225fb518..9ad45e1d27f0 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1370,6 +1370,20 @@ bool vhost_log_access_ok(struct vhost_dev *dev) > } > EXPORT_SYMBOL_GPL(vhost_log_access_ok); > > +static bool vq_log_used_access_ok(struct vhost_virtqueue *vq, > + void __user *log_base, > + bool log_used, > + u64 log_addr) > +{ > + /* If an IOTLB device is present, log_addr is a GIOVA that > + * will never be logged by log_used(). */ > + if (vq->iotlb) > + return true; > + > + return !log_used || log_access_ok(log_base, log_addr, > + vhost_get_used_size(vq, vq->num)); > +} > + > /* Verify access for write logging. */ > /* Caller should have vq mutex and device mutex */ > static bool vq_log_access_ok(struct vhost_virtqueue *vq, > @@ -1377,8 +1391,7 @@ static bool vq_log_access_ok(struct vhost_virtqueue *vq, > { > return vq_memory_access_ok(log_base, vq->umem, > vhost_has_feature(vq, VHOST_F_LOG_ALL)) && > - (!vq->log_used || log_access_ok(log_base, vq->log_addr, > - vhost_get_used_size(vq, vq->num))); > + vq_log_used_access_ok(vq, log_base, vq->log_used, vq->log_addr); > } > > /* Can we start vq? */ > @@ -1517,9 +1530,9 @@ static long vhost_vring_set_addr(struct vhost_dev *d, > return -EINVAL; > > /* Also validate log access for used ring if enabled. */ > - if ((a.flags & (0x1 << VHOST_VRING_F_LOG)) && > - !log_access_ok(vq->log_base, a.log_guest_addr, > - vhost_get_used_size(vq, vq->num))) > + if (!vq_log_used_access_ok(vq, vq->log_base, > + a.flags & (0x1 << VHOST_VRING_F_LOG), > + a.log_guest_addr)) > return -EINVAL; > } > > >
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 9d2c225fb518..9ad45e1d27f0 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1370,6 +1370,20 @@ bool vhost_log_access_ok(struct vhost_dev *dev) } EXPORT_SYMBOL_GPL(vhost_log_access_ok); +static bool vq_log_used_access_ok(struct vhost_virtqueue *vq, + void __user *log_base, + bool log_used, + u64 log_addr) +{ + /* If an IOTLB device is present, log_addr is a GIOVA that + * will never be logged by log_used(). */ + if (vq->iotlb) + return true; + + return !log_used || log_access_ok(log_base, log_addr, + vhost_get_used_size(vq, vq->num)); +} + /* Verify access for write logging. */ /* Caller should have vq mutex and device mutex */ static bool vq_log_access_ok(struct vhost_virtqueue *vq, @@ -1377,8 +1391,7 @@ static bool vq_log_access_ok(struct vhost_virtqueue *vq, { return vq_memory_access_ok(log_base, vq->umem, vhost_has_feature(vq, VHOST_F_LOG_ALL)) && - (!vq->log_used || log_access_ok(log_base, vq->log_addr, - vhost_get_used_size(vq, vq->num))); + vq_log_used_access_ok(vq, log_base, vq->log_used, vq->log_addr); } /* Can we start vq? */ @@ -1517,9 +1530,9 @@ static long vhost_vring_set_addr(struct vhost_dev *d, return -EINVAL; /* Also validate log access for used ring if enabled. */ - if ((a.flags & (0x1 << VHOST_VRING_F_LOG)) && - !log_access_ok(vq->log_base, a.log_guest_addr, - vhost_get_used_size(vq, vq->num))) + if (!vq_log_used_access_ok(vq, vq->log_base, + a.flags & (0x1 << VHOST_VRING_F_LOG), + a.log_guest_addr)) return -EINVAL; }
When the IOTLB device is enabled, the log_guest_addr that is passed by userspace to the VHOST_SET_VRING_ADDR ioctl, and which is then written to vq->log_addr, is a GIOVA. All writes to this address are translated by log_user() to writes to an HVA, and then ultimately logged through the corresponding GPAs in log_write_hva(). No logging will ever occur with vq->log_addr in this case. It is thus wrong to pass vq->log_addr and log_guest_addr to log_access_vq() which assumes they are actual GPAs. Introduce a new vq_log_used_access_ok() helper that only checks accesses to the log for the used structure when there isn't an IOTLB device around. Signed-off-by: Greg Kurz <groug@kaod.org> --- drivers/vhost/vhost.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)