Commit 90fdd158 authored by Steve Sistare's avatar Steve Sistare Committed by Alex Williamson
Browse files

vfio/type1: restore locked_vm 



When a vfio container is preserved across exec or fork-exec, the new
task's mm has a locked_vm count of 0.  After a dma vaddr is updated using
VFIO_DMA_MAP_FLAG_VADDR, locked_vm remains 0, and the pinned memory does
not count against the task's RLIMIT_MEMLOCK.

To restore the correct locked_vm count, when VFIO_DMA_MAP_FLAG_VADDR is
used and the dma's mm has changed, add the dma's locked_vm count to
the new mm->locked_vm, subject to the rlimit, and subtract it from the
old mm->locked_vm.

Fixes: c3cbab24 ("vfio/type1: implement interfaces to update vaddr")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSteve Sistare <steven.sistare@oracle.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Reviewed-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/1675184289-267876-5-git-send-email-steven.sistare@oracle.com


Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
parent 18e29270

drivers/vfio/vfio_iommu_type1.c

+35 −0
Original line number Diff line number Diff line
@@ -1591,6 +1591,38 @@ static bool vfio_iommu_iova_dma_valid(struct vfio_iommu *iommu, 
	return list_empty(iova);

}



static int vfio_change_dma_owner(struct vfio_dma *dma)

{

	struct task_struct *task = current->group_leader;

	struct mm_struct *mm = current->mm;

	long npage = dma->locked_vm;

	bool lock_cap;

	int ret;



	if (mm == dma->mm)

		return 0;



	lock_cap = capable(CAP_IPC_LOCK);

	ret = mm_lock_acct(task, mm, lock_cap, npage);

	if (ret)

		return ret;



	if (mmget_not_zero(dma->mm)) {

		mm_lock_acct(dma->task, dma->mm, dma->lock_cap, -npage);

		mmput(dma->mm);

	}



	if (dma->task != task) {

		put_task_struct(dma->task);

		dma->task = get_task_struct(task);

	}

	mmdrop(dma->mm);

	dma->mm = mm;

	mmgrab(dma->mm);

	dma->lock_cap = lock_cap;

	return 0;

}



static int vfio_dma_do_map(struct vfio_iommu *iommu,

			   struct vfio_iommu_type1_dma_map *map)

{
@@ -1640,6 +1672,9 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu, 
			   dma->size != size) {

			ret = -EINVAL;

		} else {

			ret = vfio_change_dma_owner(dma);

			if (ret)

				goto out_unlock;

			dma->vaddr = vaddr;

			dma->vaddr_invalid = false;

			iommu->vaddr_invalid_count--;