Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: rQU92St886akbCYbC4XlGNwpM9h15EIqRKlasB33YKKOhQrwJygrGRRebLnKMB21hvaHgAZFtV
 n8uLS38LgsBw==
IronPort-SDR: Wv0DZAy2BrReKb6Rf0xFM4tquxPjicOyP5MuerqfDBw8TX759J5MEpM0V+72UI+NE5RIXABSFP
 x29gxEEGoYKA==
From:   "Tian, Kevin" <kevin.tian@intel.com>
To:     Jason Gunthorpe <jgg@nvidia.com>,
        "Jiang, Dave" <dave.jiang@intel.com>
CC:     "alex.williamson@redhat.com" <alex.williamson@redhat.com>,
        "kwankhede@nvidia.com" <kwankhede@nvidia.com>,
        "tglx@linutronix.de" <tglx@linutronix.de>,
        "vkoul@kernel.org" <vkoul@kernel.org>,
        "Dey, Megha" <megha.dey@intel.com>,
        "Pan, Jacob jun" <jacob.jun.pan@intel.com>,
        "Raj, Ashok" <ashok.raj@intel.com>,
        "Liu, Yi L" <yi.l.liu@intel.com>, "Lu, Baolu" <baolu.lu@intel.com>,
        "Kumar, Sanjay K" <sanjay.k.kumar@intel.com>,
        "Luck, Tony" <tony.luck@intel.com>,
        "Williams, Dan J" <dan.j.williams@intel.com>,
        "eric.auger@redhat.com" <eric.auger@redhat.com>,
        "parav@mellanox.com" <parav@mellanox.com>,
        "netanelg@mellanox.com" <netanelg@mellanox.com>,
        "shahafs@mellanox.com" <shahafs@mellanox.com>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "dmaengine@vger.kernel.org" <dmaengine@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "Wang, Zhenyu Z" <zhenyu.z.wang@intel.com>
Subject: RE: [PATCH v5 05/14] vfio/mdev: idxd: add basic mdev registration and
 helper functions
Thread-Topic: [PATCH v5 05/14] vfio/mdev: idxd: add basic mdev registration
 and helper functions
Thread-Index: AQHW/AD4vwz31CjC0UGMFUWiPK3cUqpSGYEAgAkbtoCAAClrAIADaRzg
Date:   Fri, 19 Feb 2021 01:42:26 +0000
Message-ID: <MWHPR11MB1886B77D53A77DF32FF938B48C849@MWHPR11MB1886.namprd11.prod.outlook.com>
References: <161255810396.339900.7646244556839438765.stgit@djiang5-desk3.ch.intel.com>
 <161255840486.339900.5478922203128287192.stgit@djiang5-desk3.ch.intel.com>
 <20210210235924.GJ4247@nvidia.com>
 <8ff16d76-6b36-0da6-03ee-aebec2d1a731@intel.com>
 <20210216213310.GJ4247@nvidia.com>
In-Reply-To: <20210216213310.GJ4247@nvidia.com>
Accept-Language: en-US
Content-Language: en-US
dlp-version: 11.5.1.3
dlp-product: dlpe-windows
dlp-reaction: no-action
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: cdef6cfb-66c4-430a-bfe5-08d8d4779c85
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Feb 2021 01:42:26.3163
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: SSEuA0E7WNkLSYgbRArChdePCEjvYsbfxs6kTdADspTDLKSqeC7kJ15RPyP2y4C+T9384UPe+AI92/CkBrOvbg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW3PR11MB4697
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

> From: Jason Gunthorpe <jgg@nvidia.com>
> Sent: Wednesday, February 17, 2021 5:33 AM
>=20
> On Tue, Feb 16, 2021 at 12:04:55PM -0700, Dave Jiang wrote:
>=20
> > > > +	return remap_pfn_range(vma, vma->vm_start, pgoff, req_size,
> pg_prot);
> > > Nothing validated req_size - did you copy this from the Intel RDMA
> > > driver? It had a huge security bug just like this.
>=20
> > Thanks. Will add. Some of the code came from the Intel i915 mdev
> > driver.
>=20
> Please make sure it is fixed as well, the security bug is huge.
>=20

It's already been fixed 2yrs ago:

commit 51b00d8509dc69c98740da2ad07308b630d3eb7d
Author: Zhenyu Wang <zhenyuw@linux.intel.com>
Date:   Fri Jan 11 13:58:53 2019 +0800

    drm/i915/gvt: Fix mmap range check

    This is to fix missed mmap range check on vGPU bar2 region
    and only allow to map vGPU allocated GMADDR range, which means
    user space should support sparse mmap to get proper offset for
    mmap vGPU aperture. And this takes care of actual pgoff in mmap
    request as original code always does from beginning of vGPU
    aperture.

    Fixes: 659643f7d814 ("drm/i915/gvt/kvmgt: add vfio/mdev support to KVMG=
T")
    Cc: "Monroy, Rodrigo Axel" <rodrigo.axel.monroy@intel.com>
    Cc: "Orrala Contreras, Alfredo" <alfredo.orrala.contreras@intel.com>
    Cc: stable@vger.kernel.org # v4.10+
    Reviewed-by: Hang Yuan <hang.yuan@intel.com>
    Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>

Thanks
Kevin