Re: [PATCH v7 5/6] vfio/pci: Add PCIe TPH GET_ST interface

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Missing op->argsz validation before copying the st structure from user space.
--

commit 3e63e4fb1478346ccd55bac2783b7a7e1dce2cc3
Author: Chengwen Feng <fengchengwen@huawei.com>
vfio/pci: Add PCIe TPH GET_ST interface

Add support to batch get CPU steering tags for device-specific TPH mode
that does not implement an ST table. This interface requires enabling the
'enable_unsafe_tph_ds_mode' module parameter.

> diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
> --- a/drivers/vfio/pci/vfio_pci_core.c
> +++ b/drivers/vfio/pci/vfio_pci_core.c
[ ... ]
> @@ -1533,6 +1533,77 @@ static int vfio_pci_tph_disable(struct vfio_pci_core_device *vdev)
> +static int vfio_pci_tph_get_st(struct vfio_pci_core_device *vdev,
> +			       struct vfio_device_pci_tph_op *op,
> +			       void __user *uarg)
> +{
> +	struct pci_dev *pdev = vdev->pdev;
> +	struct vfio_pci_tph_entry *ents;
> +	struct vfio_pci_tph_st st;
> +	enum tph_mem_type mtype;
> +	size_t size, ents_off;
> +	int i, err;
> +
> +	if (!enable_unsafe_tph_ds_mode ||
> +		pcie_tph_get_st_table_loc(pdev) != PCI_TPH_LOC_NONE)
> +		return -EOPNOTSUPP;
> +
> +	if (copy_from_user(&st, uarg, sizeof(st)))
> +		return -EFAULT;

Should this code validate op->argsz before copying the structure from user
space?

If a user program passes an argsz that is smaller than sizeof(st), and
the provided pointer happens to be at the very end of a mapped page,
copy_from_user() will attempt to read into unmapped memory and return
-EFAULT instead of the expected -EINVAL.

Other VFIO ioctl implementations, such as vfio_pci_tph_enable(), check
op->argsz before calling copy_from_user().

> +
> +	/* Check reserved fields are zero */
> +	if (memchr_inv(&st.reserved, 0, sizeof(st.reserved)))
> +		return -EINVAL;
> +
> +	if (!st.count || st.count > VFIO_PCI_TPH_MAX_ENTRIES)
> +		return -EINVAL;
> +
> +	size = st.count * sizeof(*ents);
> +	if (op->argsz < offsetofend(struct vfio_device_pci_tph_op, st) + size)
> +		return -EINVAL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260507130956.34441-1-fengchengwen@huawei.com?part=5