Public bug reported:
[Impact]
Several upstream fixes to the vfio/pci and iommufd dma-buf code are missing. The
affected today and includes memory-safety defects:
* dma-buf revoke returns before invalidation completes; kref can underflow
after
revoke (use-after-free class)
* iommufd tears down pages state before detaching from the dmabuf
* PCI/P2PDMA returns a provider for BARs that cannot be mapped
* iommufd allows DMABUF pages into the access pin path, where they are invalid
[Fix]
Cherry-pick the upstream fixes:
1a8a5227f229 vfio: Wait for dma-buf invalidation to complete
951ebc18d181 PCI/P2PDMA: Avoid returning a provider for non_mappable_bars
f2d70dbd3dce iommufd: Destroy the pages content after detaching from dmabuf
298ab7e6f163 iommufd: Clarify IOAS_MAP_FILE dma-buf support
c64a647c84f3 vfio/pci: fix dma-buf kref underflow after revoke
dba4254e216d iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()
5f3fc0ad9a41 iommufd: Reject DMABUF pages from the access pin path
Plus two prerequisites. This tree predates the rename, so 1a8a5227f229 does not
apply without it. Upstream split the rename across two commits; both are needed
or the build breaks on the RDMA callers:
95308225e5ba dma-buf: Rename dma_buf_move_notify() to
dma_buf_invalidate_mappings()
61c0f69a2ff79 RDMA/uverbs: Update for semantic conflict with drm-misc
** Affects: linux-nvidia-7.0 (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux-nvidia-bos (Ubuntu)
Importance: Undecided
Status: New
** Also affects: linux-nvidia-7.0 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167041
Title:
Backport upstream fixes for the vfio/pci and iommufd dma-buf series
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-nvidia-7.0/+bug/2167041/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
