At the moment pages used for TCE tables (not pages addressed by TCEs) are
not counter in locked_vm counter so a malicious userspace tool can
call ioctl(KVM_CREATE_SPAPR_TCE) as many times as RLIMIT_NOFILE and
lock a lot of memory.
This adds counting for pages used for TCE tables.
This counts the number of pages required for a table plus pages for
the kvmppc_spapr_tce_table struct (TCE table descriptor) itself.
This does not change the amount of (de)allocated memory.
Signed-off-by: Alexey Kardashevskiy <a...@ozlabs.ru>
---
Changes:
v4:
* fixed counting for kvmppc_spapr_tce_table (used to be +1 page)
* added 2 helpers to common MM code for later reuse from vfio-spapr
---
arch/powerpc/kvm/book3s_64_vio.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index 5958f7d..b32aeb1 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -45,16 +45,33 @@ static long kvmppc_stt_npages(unsigned long window_size)
* sizeof(u64), PAGE_SIZE) / PAGE_SIZE;
}
+static long kvmppc_account_memlimit(long npages, bool inc)
+{
+ long stt_pages = ALIGN(sizeof(struct kvmppc_spapr_tce_table) +
+ (abs(npages) * sizeof(struct page *)), PAGE_SIZE);
+
+ npages += stt_pages;
+ if (inc)
+ return try_increment_locked_vm(npages);
+
+ decrement_locked_vm(npages);
+
+ return 0;
+}
+
static void release_spapr_tce_table(struct rcu_head *head)
{
struct kvmppc_spapr_tce_table *stt = container_of(head,
struct kvmppc_spapr_tce_table, rcu);
int i;
+ long npages = kvmppc_stt_npages(stt->window_size);
- for (i = 0; i < kvmppc_stt_npages(stt->window_size); i++)
+ for (i = 0; i < npages; i++)
__free_page(stt->pages[i]);
kvm_put_kvm(stt->kvm);
kfree(stt);
+
+ kvmppc_account_memlimit(npages, false);
}
static int kvm_spapr_tce_fault(struct vm_area_struct *vma, struct vm_fault
*vmf)
@@ -115,6 +132,9 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
}
npages = kvmppc_stt_npages(args->window_size);
+ ret = kvmppc_account_memlimit(npages, true);
+ if (ret)
+ goto fail;
stt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),
GFP_KERNEL);
--
2.0.0
_______________________________________________
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev
