vfio/pci: Fallback huge faults for unaligned pfn

The PFN must also be aligned to the fault order to insert a huge
pfnmap.  Test the alignment and fallback when unaligned.

Fixes: f9e54c3a2f5b ("vfio/pci: implement huge_fault support")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=219619
Reported-by: Athul Krishna <athul.krishna.kr@protonmail.com>
Reported-by: Precific <precification@posteo.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: Precific <precification@posteo.de>
Link: https://lore.kernel.org/r/20250102183416.1841878-1-alex.williamson@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 1ab58da9f38a6eae6077cbb88efb1d667215efee..1a4ed5a357d360be795a1ce3e152bc6aff65ec72 100644 (file)
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -1661,14 +1661,15 @@ static vm_fault_t vfio_pci_mmap_huge_fault(struct vm_fault *vmf,
        unsigned long pfn, pgoff = vmf->pgoff - vma->vm_pgoff;
        vm_fault_t ret = VM_FAULT_SIGBUS;
 
-       if (order && (vmf->address & ((PAGE_SIZE << order) - 1) ||
+       pfn = vma_to_pfn(vma) + pgoff;
+
+       if (order && (pfn & ((1 << order) - 1) ||
+                     vmf->address & ((PAGE_SIZE << order) - 1) ||
                      vmf->address + (PAGE_SIZE << order) > vma->vm_end)) {
                ret = VM_FAULT_FALLBACK;
                goto out;
        }
 
-       pfn = vma_to_pfn(vma);
-
        down_read(&vdev->memory_lock);
 
        if (vdev->pm_runtime_engaged || !__vfio_pci_memory_enabled(vdev))
@@ -1676,18 +1677,18 @@ static vm_fault_t vfio_pci_mmap_huge_fault(struct vm_fault *vmf,
 
        switch (order) {
        case 0:
-               ret = vmf_insert_pfn(vma, vmf->address, pfn + pgoff);
+               ret = vmf_insert_pfn(vma, vmf->address, pfn);
                break;
 #ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP
        case PMD_ORDER:
-               ret = vmf_insert_pfn_pmd(vmf, __pfn_to_pfn_t(pfn + pgoff,
-                                                            PFN_DEV), false);
+               ret = vmf_insert_pfn_pmd(vmf,
+                                        __pfn_to_pfn_t(pfn, PFN_DEV), false);
                break;
 #endif
 #ifdef CONFIG_ARCH_SUPPORTS_PUD_PFNMAP
        case PUD_ORDER:
-               ret = vmf_insert_pfn_pud(vmf, __pfn_to_pfn_t(pfn + pgoff,
-                                                            PFN_DEV), false);
+               ret = vmf_insert_pfn_pud(vmf,
+                                        __pfn_to_pfn_t(pfn, PFN_DEV), false);
                break;
 #endif
        default: