From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id AF7B5A046B for ; Wed, 21 Aug 2019 15:04:22 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id A5DD21BF10; Wed, 21 Aug 2019 15:04:10 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by dpdk.org (Postfix) with ESMTP id 8D5221BF08; Wed, 21 Aug 2019 15:04:08 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Aug 2019 06:04:07 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,412,1559545200"; d="scan'208";a="172770074" Received: from irvmail001.ir.intel.com ([163.33.26.43]) by orsmga008.jf.intel.com with ESMTP; 21 Aug 2019 06:04:05 -0700 Received: from wgcvswdev001.ir.intel.com (wgcvswdev001.ir.intel.com [10.102.246.100]) by irvmail001.ir.intel.com (8.14.3/8.13.6/MailSET/Hub) with ESMTP id x7LD441e029310; Wed, 21 Aug 2019 14:04:04 +0100 Received: from wgcvswdev001.ir.intel.com (localhost [127.0.0.1]) by wgcvswdev001.ir.intel.com with ESMTP id x7LD3TTZ008345; Wed, 21 Aug 2019 14:03:29 +0100 Received: (from tchaitax@localhost) by wgcvswdev001.ir.intel.com with œ id x7LD3TIg008340; Wed, 21 Aug 2019 14:03:29 +0100 From: Chaitanya Babu Talluri To: dev@dpdk.org Cc: reshma.pattan@intel.com, jananeex.m.parthasarathy@intel.com, anatoly.burakov@intel.com, Chaitanya Babu Talluri , stable@dpdk.org Date: Wed, 21 Aug 2019 14:02:54 +0100 Message-Id: <1566392575-7965-3-git-send-email-tallurix.chaitanya.babu@intel.com> X-Mailer: git-send-email 1.7.0.7 In-Reply-To: <1566392575-7965-1-git-send-email-tallurix.chaitanya.babu@intel.com> References: <1566392575-7965-1-git-send-email-tallurix.chaitanya.babu@intel.com> Subject: [dpdk-dev] [PATCH 2/3] lib/eal: fix vfio unmap that succeeds unexpectedly X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Un-map of page with valid virtual address and another page's IOVA succeeds unexpectedly. An entry in user_mem_maps can refer multiple pages. Currently in such case to unmap single page, VA and IOVA related to entry in user_mem_maps is checked but not based on page (based on the page size), this is the cause. The solution is that in find_user_mem_maps, check whether user input iova is in relation with input virtual address of the page which is to be unmapped. Fixes: 73a6390859 ("vfio: allow to map other memory regions") Cc: stable@dpdk.org Signed-off-by: Chaitanya Babu Talluri --- lib/librte_eal/linux/eal/eal_vfio.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/lib/librte_eal/linux/eal/eal_vfio.c b/lib/librte_eal/linux/eal/eal_vfio.c index 104912077..04c284cb2 100644 --- a/lib/librte_eal/linux/eal/eal_vfio.c +++ b/lib/librte_eal/linux/eal/eal_vfio.c @@ -184,13 +184,13 @@ find_user_mem_map(struct user_mem_maps *user_mem_maps, uint64_t addr, uint64_t iova, uint64_t len) { uint64_t va_end = addr + len; - uint64_t iova_end = iova + len; int i; for (i = 0; i < user_mem_maps->n_maps; i++) { struct user_mem_map *map = &user_mem_maps->maps[i]; uint64_t map_va_end = map->addr + map->len; - uint64_t map_iova_end = map->iova + map->len; + uint64_t diff_addr_len = addr - map->addr; + uint64_t expected_iova = map->iova + diff_addr_len; /* check start VA */ if (addr < map->addr || addr >= map_va_end) @@ -199,11 +199,10 @@ find_user_mem_map(struct user_mem_maps *user_mem_maps, uint64_t addr, if (va_end <= map->addr || va_end > map_va_end) continue; - /* check start IOVA */ - if (iova < map->iova || iova >= map_iova_end) - continue; - /* check if IOVA end is within boundaries */ - if (iova_end <= map->iova || iova_end > map_iova_end) + /* check whether user input iova is in sync with + * user_mem_map entry's iova + */ + if (expected_iova != iova) continue; /* we've found our map */ -- 2.17.2