linux-kernel - [Question] the check of ioeventfd collision in kvm_*assign_ioeventfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bbece68b-fb39-d599-9ba7-a8ee8be16525@huawei.com>
Date:   Thu, 30 Jul 2020 22:19:49 +0800
From:   Zhenyu Ye <yezhenyu2@...wei.com>
To:     <pbonzini@...hat.com>, <mst@...hat.com>, <gleb@...hat.com>,
        <linux-kernel@...r.kernel.org>,
        <linux-arm-kernel@...ts.infradead.org>, <kvm@...r.kernel.org>,
        <kvmarm@...ts.cs.columbia.edu>,
        Xiexiangyou <xiexiangyou@...wei.com>, <ghaskins@...ell.com>
Subject: [Question] the check of ioeventfd collision in
 kvm_*assign_ioeventfd_idx

Hi all,

There are checks of ioeventfd collision in both kvm_assign_ioeventfd_idx()
and kvm_deassign_ioeventfd_idx(), however, with different logic.

In kvm_assign_ioeventfd_idx(), this is done by ioeventfd_check_collision():
---8<---
	if (_p->bus_idx == p->bus_idx &&
	    _p->addr == p->addr &&
	    (!_p->length || !p->length ||
	     (_p->length == p->length &&
	      (_p->wildcard || p->wildcard ||
	       _p->datamatch == p->datamatch))))
		// then we consider the two are the same
---8<---

The logic in kvm_deassign_ioeventfd_idx() is as follows:
---8<---
	if (p->bus_idx != bus_idx ||
	    p->eventfd != eventfd  ||
	    p->addr != args->addr  ||
	    p->length != args->len ||
	    p->wildcard != wildcard)
		continue;

	if (!p->wildcard && p->datamatch != args->datamatch)
		continue;

	// then we consider the two are the same
---8<---

As we can see, there is extra check of p->eventfd in

().  Why we don't check p->eventfd
in kvm_assign_ioeventfd_idx()? Or should we delete this in
kvm_deassign_ioeventfd_idx()?


Thanks,
Zhenyu