The code seems to stuff these pfns into iommu pts (or something like
that, I didn't follow), but there's no mmu_notifier to ensure that
access is synchronized with pte updates.

Hence mark these as unsafe. This means that with
CONFIG_STRICT_FOLLOW_PFN, these will be rejected.

Real fix is to wire up an mmu_notifier ... somehow. Probably means any
invalidate is a fatal fault for this vfio device, but then this
shouldn't ever happen if userspace is reasonable.

Signed-off-by: Daniel Vetter <daniel.vet...@intel.com>
Cc: Jason Gunthorpe <j...@ziepe.ca>
Cc: Kees Cook <keesc...@chromium.org>
Cc: Dan Williams <dan.j.willi...@intel.com>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: John Hubbard <jhubb...@nvidia.com>
Cc: Jérôme Glisse <jgli...@redhat.com>
Cc: Jan Kara <j...@suse.cz>
Cc: Dan Williams <dan.j.willi...@intel.com>
Cc: linux...@kvack.org
Cc: linux-arm-ker...@lists.infradead.org
Cc: linux-samsung-...@vger.kernel.org
Cc: linux-me...@vger.kernel.org
Cc: Alex Williamson <alex.william...@redhat.com>
Cc: Cornelia Huck <coh...@redhat.com>
Cc: k...@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vet...@ffwll.ch>
---
 drivers/vfio/vfio_iommu_type1.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 67e827638995..10170723bb58 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -421,7 +421,7 @@ static int follow_fault_pfn(struct vm_area_struct *vma, 
struct mm_struct *mm,
 {
        int ret;
 
-       ret = follow_pfn(vma, vaddr, pfn);
+       ret = unsafe_follow_pfn(vma, vaddr, pfn);
        if (ret) {
                bool unlocked = false;
 
@@ -435,7 +435,7 @@ static int follow_fault_pfn(struct vm_area_struct *vma, 
struct mm_struct *mm,
                if (ret)
                        return ret;
 
-               ret = follow_pfn(vma, vaddr, pfn);
+               ret = unsafe_follow_pfn(vma, vaddr, pfn);
        }
 
        return ret;
-- 
2.29.2

Reply via email to