[PATCH v4 14/23] iommufd: Add mmap interface

[Nicolin Chen]

On Fri, May 16, 2025 at 10:29:56AM -0300, Jason Gunthorpe wrote:
> On Fri, May 16, 2025 at 04:08:25AM +0000, Tian, Kevin wrote:
> > > From: Jason Gunthorpe <jgg at nvidia.com>
> > > Sent: Friday, May 16, 2025 12:47 AM
> > > 
> > > On Thu, May 08, 2025 at 08:02:35PM -0700, Nicolin Chen wrote:
> > > > +	/* vma->vm_pgoff carries an index to an mtree entry (immap) */
> > > > +	immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff);
> > > > +	if (!immap)
> > > > +		return -ENXIO;
> > > > +	if (length >> PAGE_SHIFT != immap->num_pfns)
> > > > +		return -ENXIO;
> > > 
> > > This needs to validate that vm_pgoff is at the start of the immap or
> > > num_pfns is the wrong thing to validate length against.
> > > 
> > 
> > vm_pgoff is the index into mtree. If it's wrong mtree_load() will
> > fail already?
> 
> I'm not sure? I thought mtree_load will return any range that
> intersects with the given index?
> 
> Otherwise what is the point of having a range based datastructure?

Yea, I can confirm that providing a vm_pgoff that's in the range
(though not the startp) could get immap too.

I am adding negative test coverage for the vm_pgoff/length input
for the following ifs:

+       /* vma->vm_pgoff carries an index to an mtree entry (immap) */
+       immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff);
+       if (!immap)
+               return -ENXIO;
+       /* Validate the vm_pgoff and length against the registered region */
+       if (vma->vm_pgoff != immap->startp)
+               return -ENXIO;
+       if (length != immap->num_pfns << PAGE_SHIFT)
+               return -ENXIO;

Thanks
Nicolin