[PATCH v4 13/27] vfio/pci: Refuse read/write to an excluded BAR sub-range
| Newsgroups | org.kernel.vger.linux-cxl,org.kernel.vger.kvm,org.kernel.vger.linux-doc,org.kernel.vger.linux-hardening,org.kernel.vger.linux-kernel,org.kernel.vger.linux-kselftest,org.kernel.vger.linux-pci |
|---|---|
| Message-ID | <[email protected]> |
From: Manish Honap <[email protected]> Excluding a BAR sub-range from mmap is not enough on its own: the region read/write path still reaches the underlying registers. Refuse an access that overlaps the excluded range there too, so the only way in is the provider's trap. Signed-off-by: Manish Honap <[email protected]> --- drivers/vfio/pci/vfio_pci_rdwr.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c index 7f14dd46de17..2ce18e75a5ae 100644 --- a/drivers/vfio/pci/vfio_pci_rdwr.c +++ b/drivers/vfio/pci/vfio_pci_rdwr.c @@ -223,6 +223,10 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vdev, char __user *buf, count = min(count, (size_t)(end - pos)); + /* An excluded sub-range is reached only through its trap. */ + if (vfio_pci_bar_is_excluded(vdev, bar, pos, count)) + return -EINVAL; + if (bar == PCI_ROM_RESOURCE) { /* * The ROM can fill less space than the BAR, so we start the @@ -423,6 +427,10 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vdev, loff_t offset, pos >= vdev->msix_offset + vdev->msix_size)) return -EINVAL; + /* An excluded sub-range is reached only through its trap. */ + if (vfio_pci_bar_is_excluded(vdev, bar, pos, count)) + return -EINVAL; + if (count == 8) return -EINVAL; -- 2.25.1