archive mirror
 help / color / mirror / Atom feed
From: Alex Williamson <>
Subject: [PATCH] vfio/type1: Limit DMA mappings per container
Date: Mon, 01 Apr 2019 14:16:52 -0600	[thread overview]
Message-ID: <155414977872.12780.13728555131525362206.stgit@gimli.home> (raw)

Memory backed DMA mappings are accounted against a user's locked
memory limit, including multiple mappings of the same memory.  This
accounting bounds the number of such mappings that a user can create.
However, DMA mappings that are not backed by memory, such as DMA
mappings of device MMIO via mmaps, do not make use of page pinning
and therefore do not count against the user's locked memory limit.
These mappings still consume memory, but the memory is not well
associated to the process for the purpose of oom killing a task.

To add bounding on this use case, we introduce a limit to the total
number of concurrent DMA mappings that a user is allowed to create.
This limit is exposed as a tunable module option where the default
value of 64K is expected to be well in excess of any reasonable use
case (a large virtual machine configuration would typically only make
use of tens of concurrent mappings).

This fixes CVE-2019-3882.

Signed-off-by: Alex Williamson <>
 drivers/vfio/vfio_iommu_type1.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 73652e21efec..7fc8fd7d4dc7 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -58,12 +58,18 @@ module_param_named(disable_hugepages,
 		 "Disable VFIO IOMMU support for IOMMU hugepages.");
+static int dma_entry_limit __read_mostly = U16_MAX;
+module_param_named(dma_entry_limit, dma_entry_limit, int, 0644);
+		 "Maximum number of user DMA mappings per container (65535).");
 struct vfio_iommu {
 	struct list_head	domain_list;
 	struct vfio_domain	*external_domain; /* domain for external user */
 	struct mutex		lock;
 	struct rb_root		dma_list;
 	struct blocking_notifier_head notifier;
+	atomic_t		dma_avail;
 	bool			v2;
 	bool			nesting;
@@ -836,6 +842,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
 	vfio_unlink_dma(iommu, dma);
+	atomic_inc(&iommu->dma_avail);
 static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
@@ -1081,8 +1088,14 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
 		goto out_unlock;
+	if (!atomic_add_unless(&iommu->dma_avail, -1, 0)) {
+		ret = -ENOSPC;
+		goto out_unlock;
+	}
 	dma = kzalloc(sizeof(*dma), GFP_KERNEL);
 	if (!dma) {
+		atomic_inc(&iommu->dma_avail);
 		ret = -ENOMEM;
 		goto out_unlock;
@@ -1583,6 +1596,7 @@ static void *vfio_iommu_type1_open(unsigned long arg)
 	iommu->dma_list = RB_ROOT;
+	atomic_set(&iommu->dma_avail, dma_entry_limit);

             reply	other threads:[~2019-04-01 20:16 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-01 20:16 Alex Williamson [this message]
2019-04-02  2:41 ` [PATCH] vfio/type1: Limit DMA mappings per container Peter Xu
2019-04-02  4:34   ` Alex Williamson
2019-04-02  5:18     ` Peter Xu
2019-04-02 14:40       ` Alex Williamson
2019-04-02 14:58 ` Cornelia Huck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=155414977872.12780.13728555131525362206.stgit@gimli.home \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).