Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bb531888-5902-2d27-f535-0248d4db71fe@intel.com>
Date:   Tue, 1 Aug 2023 14:21:45 +0300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [PATCH v4 01/29] drm/i915/gvt: Verify pfn is "valid" before
 dereferencing "struct page"
Content-Language: en-US
To:     Sean Christopherson <seanjc@google.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Zhenyu Wang <zhenyuw@linux.intel.com>
CC:     <kvm@vger.kernel.org>, <intel-gvt-dev@lists.freedesktop.org>,
        <intel-gfx@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>,
        Yan Zhao <yan.y.zhao@intel.com>,
        Yongwei Ma <yongwei.ma@intel.com>,
        Ben Gardon <bgardon@google.com>
References: <20230729013535.1070024-1-seanjc@google.com>
 <20230729013535.1070024-2-seanjc@google.com>
From:   "Wang, Zhi A" <zhi.a.wang@intel.com>
In-Reply-To: <20230729013535.1070024-2-seanjc@google.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SzE1ZjJ1SDM4QVU0VldqcGdpRGFZK3FySGYwVjZxTXFSdDhmbmNpSWdNbzcv?=
 =?utf-8?B?RzhVbmdCMXNiSGlwTnl6Z09xZjlkMmMwY2Y0V1FXOVN5TTl2WXYreVMvZXkx?=
 =?utf-8?B?Y2N3NURvZ053SUxydzFTZHlidWFJVlNtbzgzcHFXdkZKSXdKTnhRL1IyR1NG?=
 =?utf-8?B?ZHFnWUlUcUlYaFRDZm5DSGZaUWxWcStTK3p3RWErc3hIM2VNaURISWFsaE15?=
 =?utf-8?B?TkRyUnlOMy9VRE5qRCtsTHRkazBrbjRVV1h6RG5heGRGRHBpRWFhYlE3TjdJ?=
 =?utf-8?B?SlQwOFhjS0w5UjNnUlhkczlnZ3FxUXlGbzhuQkwwVTdwUklXR3pweUZiR1VC?=
 =?utf-8?B?eVpSOWF6VjNkRWhQVWh2YU8vR1VWSlp0QVVYK01MZ1N6bml3WUlLZFdmRm40?=
 =?utf-8?B?ZVgvc2kyMnpYVTZ6TWFHdDEzM0ZaRHlNbzNtbnN4b3E4RTl3SVROUWphajU0?=
 =?utf-8?B?Y01CdmtKZEVrN2VQLzNZODNuZzVOWERxSHVNUGJUcHdpazE5SGF4K2RNdE1o?=
 =?utf-8?B?NEQzN05pSlFFbkZqeWo0SFRDSFNKMFlkOURKUHdBV0Npb0dCVm9DQTc1ODhM?=
 =?utf-8?B?b1luTDNCMnFRTWN2amhobVJwSFZxaGczM3ZaMHYyZ2M4Z1RlWUNIQlBIN3F2?=
 =?utf-8?B?NktvbjZ6T05VWlE4WCtta3hHVkN5Y25zV1FzdUhjMmcra2haMUVIS2owY3Iw?=
 =?utf-8?B?amNacEE1akZCbG5ZNEd2TVRsbzU0NTRmYXlwWi9VcndnallobmJsK3h4a3gx?=
 =?utf-8?B?QU5lQWJSK2xibnpxZzJDTitJVWQxUUtiNVJKems3dDlUY0paNnc3Sk5ZT1FW?=
 =?utf-8?B?OCthMG1pSmo1RUlvUVh4NUpNOStuUEUzU0dSdE1ZaVN1NkkzZ2psblo4bjlE?=
 =?utf-8?B?YmJJaWRDYmRXWVNqZHZ4elJoZ3EyNjZJTm9oQ0dEL3BkQU43a2tiZDRHZjUz?=
 =?utf-8?B?b2lrQmxnQ2ZrVnlwTWF1YnFBQ1VzT2l0NVhQaGQxUEVrVWo1NHdha0NidExi?=
 =?utf-8?B?VCtGR3B4eWx6L3JyRzNoUHZzczg1dWpVRk54VXpRRThVdTNGZS9rOXFHNkN0?=
 =?utf-8?B?cm8xbnFqWUNvL3VVb2MyMVlyRzRRcmlpNWwvS0pKNFVtWmNIM0U0OHNsbGlL?=
 =?utf-8?B?UFkzVTdYaEZUczY3dVhyS3p4d0IxTFBqVXdVZnFUTFd0RWZ6M1dzWis2NDU2?=
 =?utf-8?B?UVlvbVcrbzRITlhTdER4Y2x3NStjYklRUnhyK21BT1hmdzFWak9RcEZGYjNk?=
 =?utf-8?B?aHcwTytWTHhDM1dEUVAwdEpyR1BJMWVLdjdHTHZ5THk3c2ErUnpjdmtTcnZU?=
 =?utf-8?B?TWNnd2p6QnBBeWJhS3BocmZ1cVVJTGRGUU5XWnpESlVHWXdkV05ZTDZYZ2to?=
 =?utf-8?B?Q2VDZ3g2SGE1ZDFSa1FNYWh1enpFQlEvMzBERDI3Wmo3aVdjSVBMZUpHdUZs?=
 =?utf-8?B?cFExbE8yZm9IRk5IWVYwUFVEQjhQdjdWRUlaeU5DNWpWeDVKUklYVWR3THZJ?=
 =?utf-8?B?UUFudzdSQzdmVVlhMVBtNFFOcit2TzBZSi8rK05pNDZJRkNTaW9icmVlTkI4?=
 =?utf-8?B?OFJGYjhpL3BkU0QwTHduZ1l0UUlydlFwS2Q5UjBYSVh4SFExb3ovcUkxMTZW?=
 =?utf-8?B?aTdHcmUzbTg4dGdybTYreUZRckcxRDFJaEpMTG5KQURHN2NyWEdDek1ucjQw?=
 =?utf-8?B?K2VrMVZ5aE1jb1l0WGZyR3VyM0lDbHpkZ2FuSUc4emFPWXhiVmYyUEtuQ24v?=
 =?utf-8?B?OWk5YmR3aG1FR01wZHplRGhUOGMzQ1E3bjBGeXlWelc3N2tybmF5ZStTMlYz?=
 =?utf-8?B?STBGVDMzYzA3Zk5WSUVlakJLdzVoODNsc1lvdWVSbFQveVlWa0JvWEt1WHZk?=
 =?utf-8?B?a1JXL2hsN01hSjlYSDBuNVRuakp0SnZMME9yWGxRVExCNStuY3hYdThZQXFU?=
 =?utf-8?B?S29ISXJtOVZ5cFg1Q0VpTGpBS0E4OGNZdDVSOFQxLzdjeGZyWStLSXpIZVBk?=
 =?utf-8?B?U3hFZUVMUFJGK1ZTTUo1SjNhcGZBdkpiaXY4R1lxbGk2eWpuN2lzN04vN1lF?=
 =?utf-8?B?V05BN2E5alNxQktKd2FDL1BaUEM0T0h1QkNRWTl6cEtpZDMrWjkvTGMxdVVG?=
 =?utf-8?Q?CE3Ytr5BSpSQ4BBrmj377QS0q?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 1027a527-2d22-4be0-35fb-08db928180a8
X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB5549.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Aug 2023 11:21:51.2263
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: EIIaCj8UbjFOKHsQtWmgj1GYkBNLwm4cV4JmBvaZmr0Mv4r2/zMtuBDjv25WEVn6EWOmneUxZD/6YJG94Wv85w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR11MB5521
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-2.2 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,
        SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 7/29/2023 4:35 AM, Sean Christopherson wrote:
> Check that the pfn found by gfn_to_pfn() is actually backed by "struct
> page" memory prior to retrieving and dereferencing the page.  KVM
> supports backing guest memory with VM_PFNMAP, VM_IO, etc., and so
> there is no guarantee the pfn returned by gfn_to_pfn() has an associated
> "struct page".
>
> Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
> Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
> Tested-by: Yongwei Ma <yongwei.ma@intel.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>   drivers/gpu/drm/i915/gvt/gtt.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> index 4ec85308379a..58b9b316ae46 100644
> --- a/drivers/gpu/drm/i915/gvt/gtt.c
> +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> @@ -1183,6 +1183,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu,
>   	pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry));
>   	if (is_error_noslot_pfn(pfn))
>   		return -EINVAL;
> +
> +	if (!pfn_valid(pfn))
> +		return -EINVAL;
> +
>   	return PageTransHuge(pfn_to_page(pfn));
>   }
>   

Reviewed-by: Zhi Wang <zhi.a.wang@intel.com>