> create_user_mr() builds one indirect MKey that covers the whole vhost
> IOTLB. It fills each gap between two mappings with null KLMs, one per
> GiB, and never checks the total number of KLMs against the device
> limit, MLX5_CAP_GEN(log_max_klm_list_size).
>
> With a virtio-IOMMU the guest chooses the IOVAs: the VMM (QEMU)
> forwards each map the guest makes to the vhost-vDPA device. If the
> guest maps one page at IOVA 0 and one at IOVA 2^58, the driver needs
> more than 2^28 KLMs. create_indirect_key() computes the buffer size in
> an int, which overflows: the driver allocates 336 bytes, and
> fill_indir() then writes 16 bytes per KLM, 4 GiB in total, far past
> the end of the buffer.
>
> nnuls is an int, so a gap of 2^61 bytes or more is miscounted on every
> architecture, and on 32-bit the unsigned long num_klms wraps. The gap
> [ ... ]
> Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
> Cc: [email protected]
> Co-developed-by: Nikolai Kalinin <[email protected]>
> Signed-off-by: Nikolai Kalinin <[email protected]>
> Signed-off-by: Vladimir Petrzhikovskii <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
