Re: [PATCH v4 14/23] iommufd: Add mmap interface

Nicolin Chen
2025-05-16T17:42:31Z

On Fri, May 16, 2025 at 10:29:56AM -0300, Jason Gunthorpe wrote:
> On Fri, May 16, 2025 at 04:08:25AM +0000, Tian, Kevin wrote:
> > > From: Jason Gunthorpe <jgg@nvidia.com>
> > > Sent: Friday, May 16, 2025 12:47 AM
> > >
> > > On Thu, May 08, 2025 at 08:02:35PM -0700, Nicolin Chen wrote:
> > > > + /* vma->vm_pgoff carries an index to an mtree entry (immap) */
> > > > + immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff);
> > > > + if (!immap)
> > > > + return -ENXIO;
> > > > + if (length >> PAGE_SHIFT != immap->num_pfns)
> > > > + return -ENXIO;
> > >
> > > This needs to validate that vm_pgoff is at the start of the immap or
> > > num_pfns is the wrong thing to validate length against.
> > >
> >
> > vm_pgoff is the index into mtree. If it's wrong mtree_load() will
> > fail already?
>
> I'm not sure? I thought mtree_load will return any range that
> intersects with the given index?
>
> Otherwise what is the point of having a range based datastructure?

Yea, I can confirm that providing a vm_pgoff that's in the range
(though not the startp) could get immap too.

I am adding negative test coverage for the vm_pgoff/length input
for the following ifs:

+ /* vma->vm_pgoff carries an index to an mtree entry (immap) */
+ immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff);
+ if (!immap)
+ return -ENXIO;
+ /* Validate the vm_pgoff and length against the registered region */
+ if (vma->vm_pgoff != immap->startp)
+ return -ENXIO;
+ if (length != immap->num_pfns << PAGE_SHIFT)
+ return -ENXIO;

Thanks
Nicolin