Re: [Qemu-devel] [PATCH v9 12/12] docs: Sample driver to demonstrate how to use Mediated device framework.

[Alex Williamson <alex.williamson@redhat.com>]

On Tue, 18 Oct 2016 10:54:11 +0800
Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> wrote:

> * Kirti Wankhede <kwankhede@nvidia.com> [2016-10-18 02:52:12 +0530]:
> 
> ...snip...
> 
> > +static ssize_t mdev_access(struct mdev_device *mdev, char *buf,
> > +		size_t count, loff_t pos, bool is_write)
> > +{
> > +	struct mdev_state *mdev_state;
> > +	unsigned int index;
> > +	loff_t offset;
> > +	int ret = 0;
> > +
> > +	if (!mdev || !buf)
> > +		return -EINVAL;
> > +
> > +	mdev_state = mdev_get_drvdata(mdev);
> > +	if (!mdev_state) {
> > +		pr_err("%s mdev_state not found\n", __func__);
> > +		return -EINVAL;
> > +	}
> > +
> > +	mutex_lock(&mdev_state->ops_lock);
> > +
> > +	index = MTTY_VFIO_PCI_OFFSET_TO_INDEX(pos);
> > +	offset = pos & MTTY_VFIO_PCI_OFFSET_MASK;
> > +	switch (index) {
> > +	case VFIO_PCI_CONFIG_REGION_INDEX:
> > +
> > +#if defined(DEBUG)
> > +		pr_info("%s: PCI config space %s at offset 0x%llx\n",
> > +			 __func__, is_write ? "write" : "read", offset);
> > +#endif
> > +		if (is_write) {
> > +			dump_buffer(buf, count);
> > +			handle_pci_cfg_write(mdev_state, offset, buf, count);
> > +		} else {
> > +			memcpy(buf, (mdev_state->vconfig + offset), count);
> > +			dump_buffer(buf, count);  
> Dear Kirti:
> 
> Shouldn't we use copy_from_user instead of memcpy on @buf here? And I'm
> wondering if dump_buffer could really work since it tries to dereference
> a *__user* marked pointor.

I agree, the __user attribute is getting lost here and we're operating
on user buffers as if they were kernel buffers.  That's a bug.  Thanks,

Alex
 
> Otherwise, this is a good example driver. Thanks!
> 
> > +		}
> > +
> > +		break;
> > +
> > +	case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX:
> > +		if (!mdev_state->region_info[index].start)
> > +			mdev_read_base(mdev_state);
> > +
> > +		if (is_write) {
> > +			dump_buffer(buf, count);
> > +
> > +#if defined(DEBUG_REGS)
> > +			pr_info("%s: BAR%d  WR @0x%llx %s val:0x%02x dlab:%d\n",
> > +				__func__, index, offset, wr_reg[offset],
> > +				(u8)*buf, mdev_state->s[index].dlab);
> > +#endif
> > +			handle_bar_write(index, mdev_state, offset, buf, count);
> > +		} else {
> > +			handle_bar_read(index, mdev_state, offset, buf, count);
> > +			dump_buffer(buf, count);
> > +
> > +#if defined(DEBUG_REGS)
> > +			pr_info("%s: BAR%d  RD @0x%llx %s val:0x%02x dlab:%d\n",
> > +				__func__, index, offset, rd_reg[offset],
> > +				(u8)*buf, mdev_state->s[index].dlab);
> > +#endif
> > +		}
> > +		break;
> > +
> > +	default:
> > +		ret = -1;
> > +		goto accessfailed;
> > +	}
> > +
> > +	ret = count;
> > +
> > +
> > +accessfailed:
> > +	mutex_unlock(&mdev_state->ops_lock);
> > +
> > +	return ret;
> > +}
> > +  
> ...snip...
> 
> > +ssize_t mtty_read(struct mdev_device *mdev, char __user *buf,
> > +			size_t count, loff_t *ppos)
> > +{
> > +	return mdev_access(mdev, buf, count, *ppos, false);
> > +}
> > +
> > +ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
> > +			 size_t count, loff_t *ppos)
> > +{
> > +	return mdev_access(mdev, (char *)buf, count, *ppos, true);
> > +}
> > +  
> ...snip...
>