@@ -45,16 +45,33 @@ static long kvmppc_stt_npages(unsigned long window_size)
* sizeof(u64), PAGE_SIZE) / PAGE_SIZE;
}
+static long kvmppc_account_memlimit(long npages, bool inc)
+{
+ long stt_pages = ALIGN(sizeof(struct kvmppc_spapr_tce_table) +
+ (abs(npages) * sizeof(struct page *)), PAGE_SIZE);
+
+ npages += stt_pages;
+ if (inc)
+ return try_increment_locked_vm(npages);
+
+ decrement_locked_vm(npages);
+
+ return 0;
+}
+
static void release_spapr_tce_table(struct rcu_head *head)
{
struct kvmppc_spapr_tce_table *stt = container_of(head,
struct kvmppc_spapr_tce_table, rcu);
int i;
+ long npages = kvmppc_stt_npages(stt->window_size);
- for (i = 0; i < kvmppc_stt_npages(stt->window_size); i++)
+ for (i = 0; i < npages; i++)
__free_page(stt->pages[i]);
kvm_put_kvm(stt->kvm);
kfree(stt);
+
+ kvmppc_account_memlimit(npages, false);
}
static int kvm_spapr_tce_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
@@ -115,6 +132,9 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
}
npages = kvmppc_stt_npages(args->window_size);
+ ret = kvmppc_account_memlimit(npages, true);
+ if (ret)
+ goto fail;
stt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),
GFP_KERNEL);
At the moment pages used for TCE tables (not pages addressed by TCEs) are not counter in locked_vm counter so a malicious userspace tool can call ioctl(KVM_CREATE_SPAPR_TCE) as many times as RLIMIT_NOFILE and lock a lot of memory. This adds counting for pages used for TCE tables. This counts the number of pages required for a table plus pages for the kvmppc_spapr_tce_table struct (TCE table descriptor) itself. This does not change the amount of (de)allocated memory. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> --- Changes: v4: * fixed counting for kvmppc_spapr_tce_table (used to be +1 page) * added 2 helpers to common MM code for later reuse from vfio-spapr --- arch/powerpc/kvm/book3s_64_vio.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)