linux-kernel - Re: [PATCH v6 3/4] iommu: debug-pagealloc: Track IOMMU pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260112135208.GD745888@ziepe.ca>
Date: Mon, 12 Jan 2026 09:52:08 -0400
From: Jason Gunthorpe <jgg@...pe.ca>
To: Mostafa Saleh <smostafa@...gle.com>
Cc: linux-mm@...ck.org, iommu@...ts.linux.dev, linux-kernel@...r.kernel.org,
	linux-doc@...r.kernel.org, corbet@....net, joro@...tes.org,
	will@...nel.org, robin.murphy@....com, akpm@...ux-foundation.org,
	vbabka@...e.cz, surenb@...gle.com, mhocko@...e.com,
	jackmanb@...gle.com, hannes@...xchg.org, ziy@...dia.com,
	david@...hat.com, lorenzo.stoakes@...cle.com,
	Liam.Howlett@...cle.com, rppt@...nel.org, xiaqinxin@...wei.com,
	baolu.lu@...ux.intel.com, rdunlap@...radead.org,
	Samiullah Khawaja <skhawaja@...gle.com>
Subject: Re: [PATCH v6 3/4] iommu: debug-pagealloc: Track IOMMU pages

On Mon, Jan 12, 2026 at 01:43:41PM +0000, Mostafa Saleh wrote:
> But I don’t see why not. from the documentation:
> /**
>  * pfn_valid - check if there is a valid memory map entry for a PFN
>  * @pfn: the page frame number to check
>  *
>  * Check if there is a valid memory map entry aka struct page for the @pfn.
>  * Note, that availability of the memory map entry does not imply that
>  * there is actual usable memory at that @pfn. The struct page may
>  * represent a hole or an unusable page frame.
> …
> 
> That means that struct page exists, which is all what we need here.

A struct page that has never been initialize shouldn't ever be read. I
don't know how that relates to page_ext, but are you really sure that
is all you need?

> I can see many places have the same pattern in the kernel already, for example:
> - vfio_iommu_type1.c, is_invalid_reserved_pfn() which does the same
> check which can include MMIO and then get the page struct.

This whole flow is nonsensical and wrong though, I wouldn't point to
it as something reliable.

> - kvm_main.c: in __kvm_vcpu_map(), it distinguishes MMIO from memory
> and then accesses the page struct.

That's sure looks sketchy to me.. Eg if CONFIG_WANT_PAGE_VIRTUAL is
set and you try to feed a MMIO through through that kmap() it will
explode.

KVM can argue that it doesn't work with CONFIG_WANT_PAGE_VIRTUAL but
iommu cannot.

So, again, IDK, we are trying not to use pfn_valid() in the DMA code.

Jason