diff options
| author | Lu Baolu <baolu.lu@linux.intel.com> | 2024-07-10 11:33:40 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2024-07-12 15:00:19 +0300 |
| commit | d73cf5ff743b5a8de6fa20651baba5bd56ba98a3 (patch) | |
| tree | ff78fa82f9558ebfcfd637b6f7a68dd3fb6bac9f /drivers/iommu | |
| parent | 861f96a785149a0062cce6578e0fa7cb95435a7e (diff) | |
| download | linux-d73cf5ff743b5a8de6fa20651baba5bd56ba98a3.tar.xz | |
iommufd: Add check on user response code
The response code from user space is only allowed to be SUCCESS or
INVALID. All other values are treated by the device as a response code of
Response Failure according to PCI spec, section 10.4.2.1. This response
disables the Page Request Interface for the Function.
Add a check in iommufd_fault_fops_write() to avoid invalid response
code.
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Link: https://lore.kernel.org/r/20240710083341.44617-3-baolu.lu@linux.intel.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/iommu')
| -rw-r--r-- | drivers/iommu/iommufd/fault.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/iommu/iommufd/fault.c b/drivers/iommu/iommufd/fault.c index 54d6cd20a673..9c142cefa2d2 100644 --- a/drivers/iommu/iommufd/fault.c +++ b/drivers/iommu/iommufd/fault.c @@ -305,6 +305,16 @@ static ssize_t iommufd_fault_fops_write(struct file *filep, const char __user *b if (rc) break; + static_assert((int)IOMMUFD_PAGE_RESP_SUCCESS == + (int)IOMMU_PAGE_RESP_SUCCESS); + static_assert((int)IOMMUFD_PAGE_RESP_INVALID == + (int)IOMMU_PAGE_RESP_INVALID); + if (response.code != IOMMUFD_PAGE_RESP_SUCCESS && + response.code != IOMMUFD_PAGE_RESP_INVALID) { + rc = -EINVAL; + break; + } + group = xa_erase(&fault->response, response.cookie); if (!group) { rc = -EINVAL; |