[PATCH v3 0/1] mm/memory: constrain generic_access_phys() to page boundary

[Ren Wei <weir@nebusec.ai>]

From: Luxiao Xu <rakukuip@gmail.com>

Hi all,

This patch addresses an issue in generic_access_phys() where accessing memory
across page boundaries in PFNMAP VMAs assumes physical pages are contiguous,
which can lead to accessing unintended physical memory or exceeding VMA boundaries.

In v3, we address review feedback from David Hildenbrand on v2:
1. Revert changes to __access_remote_vm(): Capping the access length to
   (PAGE_SIZE - offset) inside generic_access_phys() is completely sufficient,
   as __access_remote_vm() already loops over the requested length and handles
   short transfers.
2. Drop the redundant 'len <= 0' check.
3. Add an explanatory comment clarifying that accesses are limited to one page
   at a time because follow_pfnmap_start() only validates a single PTE.
4. Regarding min() vs min_t(): min_t(int, ...) is retained because len is a
   signed int while PAGE_SIZE is unsigned long ((1UL) << PAGE_SHIFT), which
   triggers a compile-time "signedness error" if plain min() is used.

Thanks for the reviews and guidance.

v2 -> v3:
- Drop modification to __access_remote_vm(); capping in generic_access_phys()
  is sufficient because the caller loop already handles partial transfers
  (David Hildenbrand).
- Drop unnecessary 'len <= 0' check.
- Add comment explaining the single-page limitation (David Hildenbrand).
- v2 Link: https://lore.kernel.org/all/cover.1788531737.git.rakukuip@gmail.com/

v1 -> v2:
- Drop internal multi-page loop in generic_access_phys(); clamp the chunk
  size leveraging the existing caller loop (David Hildenbrand).
- Map only PAGE_SIZE in generic_access_phys().
- Add missing (resource_size_t) cast when checking args.pfn (Andrew Morton).

Luxiao Xu (1):
  mm/memory: constrain generic_access_phys() to page boundary

 mm/memory.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

-- 
2.43.0