Re: [RFC PATCH v2 03/16] vfio/pci: Buffer ROM reads before copying to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] vfio/pci: soft lockup in vfio_pci_rom_read loops due to missing cond_resched
--

commit 27d4f4cebe481807304449721e6097b02db9fc50
Author: Shameer Kolothum <skolothumtho@nvidia.com>

vfio/pci: Buffer ROM reads before copying to userspace

This commit moves ROM reads into a separate helper, buffering the requested
ROM data and unmapping the ROM before copying it to userspace. This helps
keep userspace faults outside the recovery gate.

> diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
> --- a/drivers/vfio/pci/vfio_pci_rdwr.c
> +++ b/drivers/vfio/pci/vfio_pci_rdwr.c
[ ... ]
> +static ssize_t vfio_pci_rom_read(struct vfio_pci_core_device *vdev,
> +				 char __user *buf, size_t count, loff_t pos)
> +{
[ ... ]
> +	/*
> +	 * Certain devices (e.g. Intel X710) don't support qword
> +	 * access to the ROM bar. Otherwise PCI AER errors might be
> +	 * triggered.
> +	 *
> +	 * Disable qword access to the ROM bar universally, which
> +	 * worked reliably for years before qword access is enabled.
> +	 */
> +	while (done < length) {
> +		if (length - done >= 4 && IS_ALIGNED(pos + done, 4)) {
> +			u32 val = vfio_ioread32(io + pos + done);

[Severity: High]
Can this loop cause a soft lockup on large ROM reads?

If a userspace application or guest issues a large read on the ROM BAR (for
example, 16MB), this while loop in vfio_pci_rom_read() will perform millions
of synchronous MMIO reads without yielding.

Since each MMIO read can take significant time, this could stall the CPU core
for seconds and trigger a soft lockup panic. Should this loop include a
cond_resched() to prevent an untrusted guest from causing a local Denial of
Service?

> +
> +			memcpy(data + done, &val, sizeof(val));
> +			done += sizeof(val);
> +		} else if (length - done >= 2 && IS_ALIGNED(pos + done, 2)) {
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929173305.204856-1-skolothumtho@nvidia.com?part=3