On Fri, May 16, 2025 at 10:29:56AM -0300, Jason Gunthorpe wrote: > On Fri, May 16, 2025 at 04:08:25AM +0000, Tian, Kevin wrote: > > > From: Jason Gunthorpe <j...@nvidia.com> > > > Sent: Friday, May 16, 2025 12:47 AM > > > > > > On Thu, May 08, 2025 at 08:02:35PM -0700, Nicolin Chen wrote: > > > > + /* vma->vm_pgoff carries an index to an mtree entry (immap) */ > > > > + immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff); > > > > + if (!immap) > > > > + return -ENXIO; > > > > + if (length >> PAGE_SHIFT != immap->num_pfns) > > > > + return -ENXIO; > > > > > > This needs to validate that vm_pgoff is at the start of the immap or > > > num_pfns is the wrong thing to validate length against. > > > > > > > vm_pgoff is the index into mtree. If it's wrong mtree_load() will > > fail already? > > I'm not sure? I thought mtree_load will return any range that > intersects with the given index? > > Otherwise what is the point of having a range based datastructure?
Yea, I can confirm that providing a vm_pgoff that's in the range (though not the startp) could get immap too. I am adding negative test coverage for the vm_pgoff/length input for the following ifs: + /* vma->vm_pgoff carries an index to an mtree entry (immap) */ + immap = mtree_load(&ictx->mt_mmap, vma->vm_pgoff); + if (!immap) + return -ENXIO; + /* Validate the vm_pgoff and length against the registered region */ + if (vma->vm_pgoff != immap->startp) + return -ENXIO; + if (length != immap->num_pfns << PAGE_SHIFT) + return -ENXIO; Thanks Nicolin
