linux-kernel - Re: [RFC v4 5/8] hisi_acc_vfio_pci: Restrict access to VF dev BAR2 migration region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20220210151940.GA446748@nvidia.com>
Date:   Thu, 10 Feb 2022 11:19:40 -0400
From:   Jason Gunthorpe <jgg@...dia.com>
To:     Shameerali Kolothum Thodi <shameerali.kolothum.thodi@...wei.com>
Cc:     Alex Williamson <alex.williamson@...hat.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "cohuck@...hat.com" <cohuck@...hat.com>,
        "mgurtovoy@...dia.com" <mgurtovoy@...dia.com>,
        "yishaih@...dia.com" <yishaih@...dia.com>,
        Linuxarm <linuxarm@...wei.com>,
        liulongfang <liulongfang@...wei.com>,
        "Zengtao (B)" <prime.zeng@...ilicon.com>,
        Jonathan Cameron <jonathan.cameron@...wei.com>,
        "Wangzhou (B)" <wangzhou1@...ilicon.com>
Subject: Re: [RFC v4 5/8] hisi_acc_vfio_pci: Restrict access to VF dev BAR2
 migration region

On Thu, Feb 10, 2022 at 03:01:50PM +0000, Shameerali Kolothum Thodi wrote:
> > > +	unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos);
> > > +	struct vfio_pci_core_device *vdev =
> > > +		container_of(core_vdev, struct vfio_pci_core_device, vdev);
> > > +
> > > +	if (index == VFIO_PCI_BAR2_REGION_INDEX) {
> > > +		loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK;
> > > +		resource_size_t end = pci_resource_len(vdev->pdev, index) / 2;
> > 
> > Be careful here, there are nested assignment use cases.  This can only
> > survive one level of assignment before we've restricted more than we
> > intended.  If migration support is dependent on PF access, can we use
> > that to determine when to when to expose only half the BAR and when to
> > expose the full BAR?
> 
> Ok. I will add a check here.

You might be better to just install a different ops when migration is
not supported, none of this stuff should be actived in that case.

Jason