linux-kernel - Re: [PATCH v4 14/23] iommufd: Add mmap interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aCd47XNQPL2FUx8S@Asurada-Nvidia>
Date: Fri, 16 May 2025 10:42:05 -0700
From: Nicolin Chen <nicolinc@...dia.com>
To: Jason Gunthorpe <jgg@...dia.com>
CC: "Tian, Kevin" <kevin.tian@...el.com>, "corbet@....net" <corbet@....net>,
	"will@...nel.org" <will@...nel.org>, "bagasdotme@...il.com"
	<bagasdotme@...il.com>, "robin.murphy@....com" <robin.murphy@....com>,
	"joro@...tes.org" <joro@...tes.org>, "thierry.reding@...il.com"
	<thierry.reding@...il.com>, "vdumpa@...dia.com" <vdumpa@...dia.com>,
	"jonathanh@...dia.com" <jonathanh@...dia.com>, "shuah@...nel.org"
	<shuah@...nel.org>, "jsnitsel@...hat.com" <jsnitsel@...hat.com>,
	"nathan@...nel.org" <nathan@...nel.org>, "peterz@...radead.org"
	<peterz@...radead.org>, "Liu, Yi L" <yi.l.liu@...el.com>,
	"mshavit@...gle.com" <mshavit@...gle.com>, "praan@...gle.com"
	<praan@...gle.com>, "zhangzekun11@...wei.com" <zhangzekun11@...wei.com>,
	"iommu@...ts.linux.dev" <iommu@...ts.linux.dev>, "linux-doc@...r.kernel.org"
	<linux-doc@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-tegra@...r.kernel.org"
	<linux-tegra@...r.kernel.org>, "linux-kselftest@...r.kernel.org"
	<linux-kselftest@...r.kernel.org>, "patches@...ts.linux.dev"
	<patches@...ts.linux.dev>, "mochs@...dia.com" <mochs@...dia.com>,
	"alok.a.tiwari@...cle.com" <alok.a.tiwari@...cle.com>, "vasant.hegde@....com"
	<vasant.hegde@....com>
Subject: Re: [PATCH v4 14/23] iommufd: Add mmap interface

On Fri, May 16, 2025 at 10:29:56AM -0300, Jason Gunthorpe wrote:
> On Fri, May 16, 2025 at 04:08:25AM +0000, Tian, Kevin wrote:
> > > From: Jason Gunthorpe <jgg@...dia.com>
> > > Sent: Friday, May 16, 2025 12:47 AM
> > > 
> > > On Thu, May 08, 2025 at 08:02:35PM -0700, Nicolin Chen wrote:
> > > > +	/* vma->vm_pgoff carries an index to an mtree entry (immap) */
> > > > +	immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff);
> > > > +	if (!immap)
> > > > +		return -ENXIO;
> > > > +	if (length >> PAGE_SHIFT != immap->num_pfns)
> > > > +		return -ENXIO;
> > > 
> > > This needs to validate that vm_pgoff is at the start of the immap or
> > > num_pfns is the wrong thing to validate length against.
> > > 
> > 
> > vm_pgoff is the index into mtree. If it's wrong mtree_load() will
> > fail already?
> 
> I'm not sure? I thought mtree_load will return any range that
> intersects with the given index?
> 
> Otherwise what is the point of having a range based datastructure?

Yea, I can confirm that providing a vm_pgoff that's in the range
(though not the startp) could get immap too.

I am adding negative test coverage for the vm_pgoff/length input
for the following ifs:

+       /* vma->vm_pgoff carries an index to an mtree entry (immap) */
+       immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff);
+       if (!immap)
+               return -ENXIO;
+       /* Validate the vm_pgoff and length against the registered region */
+       if (vma->vm_pgoff != immap->startp)
+               return -ENXIO;
+       if (length != immap->num_pfns << PAGE_SHIFT)
+               return -ENXIO;

Thanks
Nicolin