[PATCH v2 0/2] vfio: Fixes in iommufd vfio token handling

[PATCH v2 0/2] vfio: Fixes in iommufd vfio token handling

[Raghavendra Rao Ananta]

Hello,

The series includes a couple of bug fixes that were accidentally
introduced as a part of VFIO's vf_token management for iommufd.

Patch-1: Fixes ksize arg while copying user struct in
vfio_df_ioctl_bind_iommufd.

Patch-2: Adds missing .match_token_uuid callback in
hisi_acc_vfio_pci_migrn_ops.

Thank you.
Raghavendra

Raghavendra Rao Ananta (2):
  vfio: Fix ksize arg while copying user struct in
    vfio_df_ioctl_bind_iommufd()
  hisi_acc_vfio_pci: Add .match_token_uuid callback in
    hisi_acc_vfio_pci_migrn_ops

 drivers/vfio/device_cdev.c                     | 2 +-
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)


base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787
-- 
2.51.1.930.gacf6e81ea2-goog

[PATCH v2 1/2] vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd()

[Raghavendra Rao Ananta]

For the cases where user includes a non-zero value in 'token_uuid_ptr'
field of 'struct vfio_device_bind_iommufd', the copy_struct_from_user()
in vfio_df_ioctl_bind_iommufd() fails with -E2BIG. For the 'minsz' passed,
copy_struct_from_user() expects the newly introduced field to be zero-ed,
which would be incorrect in this case.

Fix this by passing the actual size of the kernel struct. If working
with a newer userspace, copy_struct_from_user() would copy the
'token_uuid_ptr' field, and if working with an old userspace, it would
zero out this field, thus still retaining backward compatibility.

Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
Cc: stable@vger.kernel.org
Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/vfio/device_cdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/device_cdev.c b/drivers/vfio/device_cdev.c
index 480cac3a0c274..8ceca24ac136c 100644
--- a/drivers/vfio/device_cdev.c
+++ b/drivers/vfio/device_cdev.c
@@ -99,7 +99,7 @@ long vfio_df_ioctl_bind_iommufd(struct vfio_device_file *df,
 		return ret;
 	if (user_size < minsz)
 		return -EINVAL;
-	ret = copy_struct_from_user(&bind, minsz, arg, user_size);
+	ret = copy_struct_from_user(&bind, sizeof(bind), arg, user_size);
 	if (ret)
 		return ret;
 
-- 
2.51.1.930.gacf6e81ea2-goog

[PATCH v2 2/2] hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops

[Raghavendra Rao Ananta]

The commit, <86624ba3b522> ("vfio/pci: Do vf_token checks for
VFIO_DEVICE_BIND_IOMMUFD") accidentally ignored including the
.match_token_uuid callback in the hisi_acc_vfio_pci_migrn_ops struct.
Introduce the missed callback here.

Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
Cc: stable@vger.kernel.org
Suggested-by: Longfang Liu <liulongfang@huawei.com>
Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
---
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
index fde33f54e99ec..d07093d7cc3f5 100644
--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
@@ -1564,6 +1564,7 @@ static const struct vfio_device_ops hisi_acc_vfio_pci_migrn_ops = {
 	.mmap = hisi_acc_vfio_pci_mmap,
 	.request = vfio_pci_core_request,
 	.match = vfio_pci_core_match,
+	.match_token_uuid = vfio_pci_core_match_token_uuid,
 	.bind_iommufd = vfio_iommufd_physical_bind,
 	.unbind_iommufd = vfio_iommufd_physical_unbind,
 	.attach_ioas = vfio_iommufd_physical_attach_ioas,
-- 
2.51.1.930.gacf6e81ea2-goog

Re: [PATCH v2 2/2] hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops

[Jason Gunthorpe]

On Fri, Oct 31, 2025 at 05:06:03PM +0000, Raghavendra Rao Ananta wrote:
> The commit, <86624ba3b522> ("vfio/pci: Do vf_token checks for
> VFIO_DEVICE_BIND_IOMMUFD") accidentally ignored including the
> .match_token_uuid callback in the hisi_acc_vfio_pci_migrn_ops struct.
> Introduce the missed callback here.
> 
> Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
> Cc: stable@vger.kernel.org
> Suggested-by: Longfang Liu <liulongfang@huawei.com>
> Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
> ---
>  drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
>  1 file changed, 1 insertion(+)

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason

Re: [PATCH v2 2/2] hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops

[liulongfang]

On 2025/11/1 1:06, Raghavendra Rao Ananta wrote:
> The commit, <86624ba3b522> ("vfio/pci: Do vf_token checks for
> VFIO_DEVICE_BIND_IOMMUFD") accidentally ignored including the
> .match_token_uuid callback in the hisi_acc_vfio_pci_migrn_ops struct.
> Introduce the missed callback here.
> 
> Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
> Cc: stable@vger.kernel.org
> Suggested-by: Longfang Liu <liulongfang@huawei.com>
> Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
> ---
>  drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
> index fde33f54e99ec..d07093d7cc3f5 100644
> --- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
> +++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
> @@ -1564,6 +1564,7 @@ static const struct vfio_device_ops hisi_acc_vfio_pci_migrn_ops = {
>  	.mmap = hisi_acc_vfio_pci_mmap,
>  	.request = vfio_pci_core_request,
>  	.match = vfio_pci_core_match,
> +	.match_token_uuid = vfio_pci_core_match_token_uuid,
>  	.bind_iommufd = vfio_iommufd_physical_bind,
>  	.unbind_iommufd = vfio_iommufd_physical_unbind,
>  	.attach_ioas = vfio_iommufd_physical_attach_ioas,
> 
Reviewed-by: Longfang Liu <liulongfang@huawei.com>

Thanks.
Longfang.

Re: [PATCH v2 0/2] vfio: Fixes in iommufd vfio token handling

[Alex Williamson]

On Fri, 31 Oct 2025 17:06:01 +0000
Raghavendra Rao Ananta <rananta@google.com> wrote:

> Hello,
> 
> The series includes a couple of bug fixes that were accidentally
> introduced as a part of VFIO's vf_token management for iommufd.
> 
> Patch-1: Fixes ksize arg while copying user struct in
> vfio_df_ioctl_bind_iommufd.
> 
> Patch-2: Adds missing .match_token_uuid callback in
> hisi_acc_vfio_pci_migrn_ops.
> 
> Thank you.
> Raghavendra
> 
> Raghavendra Rao Ananta (2):
>   vfio: Fix ksize arg while copying user struct in
>     vfio_df_ioctl_bind_iommufd()
>   hisi_acc_vfio_pci: Add .match_token_uuid callback in
>     hisi_acc_vfio_pci_migrn_ops
> 
>  drivers/vfio/device_cdev.c                     | 2 +-
>  drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> 
> base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787

Applied to vfio next branch for v6.19.  Thanks,

Alex