VFIO update for v6.15-rc6

- Fix an issue in vfio-pci huge_fault handling by aligning faults to
    the order, resulting in deterministic use of huge pages.  This
    avoids a race where simultaneous aligned and unaligned faults to
    the same PMD can result in a VM_FAULT_OOM and subsequent VM crash.
    (Alex Williamson)
 -----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCAA5FiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmgc4NEbHGFsZXgud2ls
 bGlhbXNvbkByZWRoYXQuY29tAAoJECObm247sIsiD0YQAIXheISbFEJA+PAGIMgf
 aMYHU8yfl9KudaR/0aufI8ex2pkEBZUIMVz2YT58f0p3dkgvGFgcGO4k+qBmZb+U
 a9eAy0aYJKCWq2s5PdbAvkiT7IiCzvXDRj/o5AjAAXv8K/PcLSZQVScPyaWjG4+g
 APvhPxdFyM2SrHDIevXXNHDLGXj5SZZzlJCnE8Koxce9rgrZOqweK3yodE559Pve
 M8gspOpXlrfBIC/EuCxAh5djL0toY5KPNkCsXyjIoIkrVMz5qE9MbJ35fykQ0AL2
 p5UgsPWOABt7gbmHZ13Ce2Lkz07pq3ZpcI+7ZiyBiDzV6d/XyWL13jrRhWK+MyIV
 yi8Q5+W1I9HAfaAWyxNQf22uzcnCMmTbnExo2Muw2eBnAkfLFZXrisx4yzaDT83c
 98cKWXBB0MRj7N7DXieaG3uv0YcE5sfkE5mOaqzyytvddVJleALWJe87cCqkCgyt
 /hAddSOW/muo06fETMH70qK3vohdCC+2CbZ8PJVGKYwKrbculhduMYK7Ll5EmAFY
 YMCPYVn9/qFttSqn9+wPOLVAgbpbHtHrZnPtHiGR0SiEDxsR84IngyU1wxipoFr2
 WEkq0QfhJcyClp8bIbF1+vulstkITqeCmPMWZMpgSUdyG14Nj/Tk8unK/ekKLibb
 +mpBiXxtba0Z7P5IjIuQd7le
 =rMiX
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v6.15-rc6' of https://github.com/awilliam/linux-vfio

Pull vfio fix from Alex Williamson:

 - Fix an issue in vfio-pci huge_fault handling by aligning faults to
   the order, resulting in deterministic use of huge pages.  This
   avoids a race where simultaneous aligned and unaligned faults to
   the same PMD can result in a VM_FAULT_OOM and subsequent VM crash.
   (Alex Williamson)

* tag 'vfio-v6.15-rc6' of https://github.com/awilliam/linux-vfio:
  vfio/pci: Align huge faults to order
This commit is contained in:
Linus Torvalds 2025-05-08 12:09:22 -07:00
commit acaa3e726f

View File

@ -1646,14 +1646,14 @@ static vm_fault_t vfio_pci_mmap_huge_fault(struct vm_fault *vmf,
{
struct vm_area_struct *vma = vmf->vma;
struct vfio_pci_core_device *vdev = vma->vm_private_data;
unsigned long pfn, pgoff = vmf->pgoff - vma->vm_pgoff;
unsigned long addr = vmf->address & ~((PAGE_SIZE << order) - 1);
unsigned long pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
unsigned long pfn = vma_to_pfn(vma) + pgoff;
vm_fault_t ret = VM_FAULT_SIGBUS;
pfn = vma_to_pfn(vma) + pgoff;
if (order && (pfn & ((1 << order) - 1) ||
vmf->address & ((PAGE_SIZE << order) - 1) ||
vmf->address + (PAGE_SIZE << order) > vma->vm_end)) {
if (order && (addr < vma->vm_start ||
addr + (PAGE_SIZE << order) > vma->vm_end ||
pfn & ((1 << order) - 1))) {
ret = VM_FAULT_FALLBACK;
goto out;
}