[Qemu-commits] [qemu/qemu] 15a730: block/nvme: Fix VFIO_MAP_DMA failed: No space left...

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 15a730e7a3aaac180df72cd5730e0617bcf44a5a
      
https://github.com/qemu/qemu/commit/15a730e7a3aaac180df72cd5730e0617bcf44a5a
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2021-07-26 (Mon, 26 Jul 2021)

  Changed paths:
    M block/nvme.c

  Log Message:
  -----------
  block/nvme: Fix VFIO_MAP_DMA failed: No space left on device

When the NVMe block driver was introduced (see commit bdd6a90a9e5,
January 2018), Linux VFIO_IOMMU_MAP_DMA ioctl was only returning
-ENOMEM in case of error. The driver was correctly handling the
error path to recycle its volatile IOVA mappings.

To fix CVE-2019-3882, Linux commit 492855939bdb ("vfio/type1: Limit
DMA mappings per container", April 2019) added the -ENOSPC error to
signal the user exhausted the DMA mappings available for a container.

The block driver started to mis-behave:

  qemu-system-x86_64: VFIO_MAP_DMA failed: No space left on device
  (qemu)
  (qemu) info status
  VM status: paused (io-error)
  (qemu) c
  VFIO_MAP_DMA failed: No space left on device
  (qemu) c
  VFIO_MAP_DMA failed: No space left on device

(The VM is not resumable from here, hence stuck.)

Fix by handling the new -ENOSPC error (when DMA mappings are
exhausted) without any distinction to the current -ENOMEM error,
so we don't change the behavior on old kernels where the CVE-2019-3882
fix is not present.

An easy way to reproduce this bug is to restrict the DMA mapping
limit (65535 by default) when loading the VFIO IOMMU module:

  # modprobe vfio_iommu_type1 dma_entry_limit=666

Cc: qemu-stable@nongnu.org
Cc: Fam Zheng <fam@euphon.net>
Cc: Maxim Levitsky <mlevitsk@redhat.com>
Cc: Alex Williamson <alex.williamson@redhat.com>
Reported-by: Michal Prívozník <mprivozn@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20210723195843.1032825-1-philmd@redhat.com
Fixes: bdd6a90a9e5 ("block: Add VFIO based NVMe driver")
Buglink: https://bugs.launchpad.net/qemu/+bug/1863333
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/65
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>


  Commit: 76bf66b9136ce373f006f68b0ef4819abc797054
      
https://github.com/qemu/qemu/commit/76bf66b9136ce373f006f68b0ef4819abc797054
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2021-07-26 (Mon, 26 Jul 2021)

  Changed paths:
    M block/nvme.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/stefanha-gitlab/tags/block-pull-request' into staging

Pull request

Phil's block/nvme.c ENOSPC fix for newer Linux kernels that return this errno.

# gpg: Signature made Mon 26 Jul 2021 09:53:01 BST
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha-gitlab/tags/block-pull-request:
  block/nvme: Fix VFIO_MAP_DMA failed: No space left on device

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/1d6f147f043b...76bf66b9136c